EUVD-2026-35520
GHSA-h3x8-fqjj-gwrg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated, low-privileged attackers on Windows 11 and Windows Server 2025. The flaw (CWE-125) allows a standard user to read beyond an allocated buffer boundary within the DWM process, resulting in high-confidence information disclosure with no integrity or availability impact. Microsoft has released patches covering all affected build ranges; no public exploit code has been identified at time of analysis.
Technical ContextAI
The Windows Desktop Window Manager (DWM) Core Library is the compositing engine responsible for rendering the Windows graphical shell, including window transparency, animations, and live thumbnails. CWE-125 (Out-of-bounds Read) describes a condition where code reads data past the end of an intended buffer, potentially exposing adjacent memory regions containing pointers, credentials, cryptographic material, or other process secrets. The CVSS vector AV:L/AC:L/PR:L/UI:N indicates the flaw is reachable locally by any standard (non-privileged) user without requiring complex conditions or user interaction. The scope is unchanged (S:U), meaning the impact is contained to the DWM process itself. Affected builds span Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 (including Server Core), per ENISA EUVD-2026-35520. Notably, the input tags this as 'Buffer Overflow,' but the assigned CWE-125 classifies it strictly as a read - not a write - operation; the tag likely reflects imprecise categorization rather than an additional exploit primitive.
RemediationAI
Apply the Microsoft security update that addresses this vulnerability. Based on EUVD version range data, the fixed builds are: Windows 11 24H2 → build 10.0.26100.8457 or later; Windows 11 25H2 → build 10.0.26200.8457 or later; Windows 11 26H1 → build 10.0.28000.2113 or later; Windows Server 2025 and Windows Server 2025 Server Core → build 10.0.26100.32860 or later. Updates can be applied via Windows Update, WSUS, or Microsoft Update Catalog. The authoritative advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48566. No vendor-documented workaround has been identified in the available data. In environments where patching is delayed, restricting interactive local logon rights to trusted users and auditing privileged session access on Windows Server 2025 deployments reduces exposure, though these are compensating controls and not substitutes for the patch.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today