Dell Display Manager CVE-2026-46733

Exploitation requires existing local access to a Windows system running Dell Display and Peripheral Manager prior to version 2.3, with at least a low-privileged (PR:L) authenticated user account; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already be able to log in or execute code locally (AV:L - not exploitable over the network), and systems on DDPM 2.3 or later, or without DDPM installed, are not affected. The specific feature/interface abused is not detailed in the description beyond the Improper Access Control (CWE-284) class, so the exact triggering component should be confirmed via Dell DSA-2026-277.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a realistic and reliable local privilege-escalation primitive: low complexity, no user interaction, and only low privileges required, yielding full system impact. However, the attack vector is strictly local (AV:L), so this is not a remotely exploitable, mass-scannable issue - it requires the attacker to already have a foothold on the machine. No EPSS score was provided, the CVE is not in CISA KEV, and no POC was indicated, so there is no evidence of active or widespread exploitation; the practical priority is therefore high for endpoints where untrusted users have local access (shared workstations, multi-user fleets) and moderate elsewhere. Note a tagging discrepancy: the supplied tags include 'Authentication Bypass' and 'RCE', but the description and CVSS (AV:L) describe local privilege escalation / local code execution, not remote code execution - treat the 'RCE' tag as imprecise and verify against the Dell advisory.

An attacker who already has a standard, low-privileged account on a Dell Windows workstation (for example, a logged-in employee or a foothold from a phishing payload) abuses the improperly access-controlled DDPM component to run code at a higher privilege level. With no user interaction and low attack complexity, this lets them escalate from limited user to a privileged context and gain durable control of the host. No public exploit code has been identified at time of analysis.