Windows DWM CVE-2026-62703

Requires an existing authenticated local session with at minimum a standard (low-privileged) user account - confirmed by CVSS PR:L and the vendor description phrase 'authorized attacker.' No special Windows features, non-default configuration, or specific OS mode is identified as a prerequisite; the DWM Core Library is loaded by default on all affected Windows desktop and server-with-GUI installations. Exploitation is limited by the local attack vector (AV:L), meaning remote unauthenticated exploitation is not possible. Server Core installations that load the affected DWM library are explicitly listed as affected. No user interaction is required once local access is established (UI:N).

The CVSS 5.5 Medium score accurately reflects the constrained threat model: AV:L limits exploitation to users with an existing local session, AC:L indicates no special bypass is needed once access is obtained, and PR:L confirms a standard (non-admin) user account suffices. The high confidentiality impact (C:H) suggests the read can expose meaningful memory - potentially credentials, tokens, or sensitive buffers in DWM's address space - rather than junk. No EPSS score was supplied; without active exploitation signals (KEV absent, POC absent), real-world priority is moderate. This vulnerability fits a post-compromise lateral-movement or credential-harvesting pattern rather than a primary attack vector. The 'Buffer Overflow' tag in the intelligence feed conflicts with CWE-125 (Out-of-bounds Read) - this should be treated as a read-only primitive unless Microsoft's advisory provides additional detail indicating a write component. No conflicting CVSS signal is present; AV:L is consistent with 'authorized attacker' phrasing in the description.

A threat actor who has already obtained a low-privileged local session on a Windows endpoint or server - through phishing, credential theft, or initial-access malware - crafts or triggers a specific DWM Core Library operation that causes an out-of-bounds read, leaking adjacent memory contents. The leaked data could include sensitive tokens, credentials, or session keys residing in DWM's address space, enabling further privilege escalation or credential reuse. No public exploit code has been identified at time of analysis.