EUVD-2026-43939
GHSA-f2m6-xw5j-vpf3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and PR:L confirmed by 'authorized attacker locally' description; C:H for memory disclosure; no integrity or availability impact per CWE-125 read-only nature.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds memory read in the Windows Desktop Window Manager (DWM) Core Library enables a locally authenticated, low-privileged user to disclose sensitive memory contents across a wide range of Windows client and server versions. The flaw is reachable by any standard user account without administrative rights, making it relevant in multi-user, shared workstation, and terminal services environments. No active exploitation is confirmed - CISA SSVC rates exploitation as 'none', EPSS sits at 0.31% (22nd percentile), and no KEV listing exists - but the broad affected surface spanning Windows 10 through Windows 11 and Server 2025 warrants timely patching.
Technical ContextAI
The Desktop Window Manager (dwm.exe) is the compositing window manager built into Windows since Vista, responsible for hardware-accelerated rendering of the graphical shell including transparency, window thumbnails, and Aero effects. It runs as a protected system process. CWE-125 (Out-of-Bounds Read) describes a condition where a program reads data beyond the allocated end of a buffer, potentially exposing adjacent heap or stack memory to the caller. In this case, the DWM Core Library performs a read operation without sufficient bounds validation, allowing a local user-mode trigger to cause the library to return data outside its intended memory region. CPE data confirms the affected scope spans cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2019, and EUVD data extends confirmed affected ranges to Windows Server 2022 and Windows Server 2025. The vulnerability is tagged as Buffer Overflow in addition to the canonical CWE-125 classification, suggesting the root cause may involve a miscalculated buffer length check in a DWM rendering or compositing code path.
RemediationAI
Apply the vendor-released patch through Windows Update or the Microsoft Update Catalog. Per EUVD-confirmed fixed build versions, target builds are: 10.0.14393.9339 for Windows 10 1607 and Server 2016; 10.0.17763.9020 for Windows 10 1809, Server 2019, and Server 2019 Server Core; 10.0.19044.7548 for Windows 10 21H2; 10.0.19045.7548 for Windows 10 22H2; 10.0.20348.5386 for Server 2022; 10.0.26100.8875 for Windows 11 24H2 and 10.0.26100.33158 for Server 2025 and Server 2025 Server Core; 10.0.26200.8875 for Windows 11 25H2; and 10.0.28000.2269 for Windows 11 26H1. Full patch details are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50437. If immediate patching is not feasible, restrict local logon rights (via Group Policy - 'Allow log on locally') to limit which accounts can reach the vulnerable DWM code path; note this is disruptive in shared desktop or terminal services environments. DWM cannot be selectively disabled on graphical Windows installations without removing the entire graphical shell, which is impractical on client systems.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today