Windows DWM Core Library CVE-2026-50437

The attacker must hold a valid local user account with at least standard (low-privileged) access - this is confirmed by the CVSS PR:L metric. Interactive local access or a Remote Desktop session to the target system is required (AV:L). No special DWM configuration or non-default feature enablement is required; DWM runs by default on all Windows graphical installations. Exploitation is strictly bounded to the local attack surface - remote unauthenticated exploitation is not possible. Defenders should note that Server Core installations appear in the CPE and EUVD scope; however, Server Core typically lacks the full graphical shell and DWM may not run in the same compositing mode - verify actual DWM presence before deprioritizing Server Core patching. The SSVC 'Automatable: no' rating indicates reliable mass exploitation is constrained, likely due to memory layout variability or timing sensitivity in triggering the out-of-bounds condition.

All available signals converge on a low operational priority despite the Medium CVSS score. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects a local-only, low-complexity information disclosure with no integrity or availability impact - a meaningful but bounded threat profile. EPSS at 0.31% (22nd percentile) is well below thresholds typically associated with exploitation in the wild. CISA's SSVC framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial', all consistent with a flaw that requires a local foothold to exploit and yields only memory read capability rather than code execution. The vulnerability does not appear in the CISA KEV catalog and no public exploit code is identified in the provided data. The primary residual risk is post-compromise lateral reconnaissance: an attacker who already has a standard user session on a multi-user system could harvest in-memory artifacts from the DWM process. The C:H metric reflects high confidentiality impact within the vulnerable system's scope but does not imply remote or unauthenticated exposure - defenders should not treat this as a perimeter-level priority.

A standard user account on a shared Windows terminal server or multi-user workstation executes a crafted application or triggers a specific DWM rendering sequence that causes the Core Library to read beyond an allocated buffer boundary. The returned out-of-bounds data may expose heap contents from adjacent DWM allocations, which an attacker can scan for authentication tokens, credential material, or other sensitive in-memory artifacts from other user sessions composited by DWM. No public exploit code exists at time of analysis, so this scenario requires custom tooling to operationalize.