Windows DWM CVE-2026-48566

Exploitation requires an active local session on the affected system with at minimum a standard (low-privileged) user account - confirmed by CVSS PR:L. No user interaction from a second party is needed once access is established (UI:N). The DWM Core Library is loaded as part of the Windows graphical session subsystem; the vulnerability is reachable wherever DWM is active, which includes standard desktop sessions and likely Remote Desktop (RDS) sessions on Windows Server 2025. There is no indication in the available data that a non-default configuration or specific feature toggle is required. Key limiting factor: the AV:L vector strictly rules out remote unauthenticated exploitation - an attacker must already hold a local account or have achieved prior foothold on the target. Impact is read-only (C:H, I:N, A:N), meaning exploitation alone does not grant code execution or persistent access.

The CVSS base score of 5.5 (Medium) reflects a local-only, low-privilege, no-interaction attack with high confidentiality impact but zero integrity or availability impact. The AV:L attack vector is the dominant risk-limiting factor - exploitation requires physical or logical local access to the target system, which eliminates the vast majority of remote threat actors. No EPSS score was provided in the intelligence feed, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no POC has been identified, consistent with a newly patched, information-disclosure-only finding. In practice, this vulnerability is most relevant in multi-tenant or shared-access Windows environments (e.g., VDI, RDS, Windows Server 2025 terminal services) where untrusted low-privileged users co-exist. In single-user workstations, the threat model is narrow. The 'Buffer Overflow' tag is potentially misleading given the CWE-125 classification - defenders should not assume write primitives or code execution risk from this finding.

A standard domain user on a shared Windows Server 2025 Remote Desktop Services host logs in and executes a crafted application that makes malformed calls to the DWM Core Library, triggering the out-of-bounds read. The read leaks adjacent memory contents - potentially including pointers, session tokens, or credentials belonging to co-located processes - which the attacker harvests to escalate privileges or pivot laterally. No public exploit code has been identified at time of analysis, so exploitation currently requires custom tooling.