Desktop Window Manager CVE-2026-69974

Exploitation requires an attacker to already have local, authenticated access to the Windows host with at least low-level user privileges (PR:L) and the ability to run code that interacts with the Desktop Window Manager (dwm.exe). The HIGH attack complexity (AC:H) indicates a meaningful limiting factor - the out-of-bounds read likely depends on winning a race condition or on specific memory/runtime state that the attacker cannot deterministically control, so exploitation is not reliable on every attempt. No user interaction is needed (UI:N) and no non-default configuration is required, but the mandatory local foothold plus high complexity substantially limit realistic risk. Impact is confined to information disclosure (C:H, I:N, A:N) with no integrity or availability effect. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers listed in EUVD.

This is a genuinely low-priority vulnerability despite its HIGH confidentiality impact rating. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7 MEDIUM) requires local access, high attack complexity, and existing low-level privileges (PR:L), which already constrains exploitation to an authenticated local user. CISA's SSVC framework reinforces this low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with AC:H), and Technical Impact=partial (an out-of-bounds read discloses memory contents but does not grant full control). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in the CISA KEV catalog and no POC was reported. All signals are consistent and point the same direction - a local, high-complexity information-disclosure bug useful mainly as a secondary primitive (e.g., defeating ASLR or leaking sensitive memory) rather than a standalone priority. The only mild tension is the C:H (HIGH confidentiality) rating against Technical Impact=partial, which reflects that while leaked data can be sensitive, the attacker needs local foothold and favorable timing to obtain it.

A low-privileged local user already present on a Windows machine runs a crafted process that interacts with the Desktop Window Manager (dwm.exe) component to trigger an out-of-bounds read, leaking adjacent process memory. Because attack complexity is HIGH, the attacker likely must win a race or satisfy specific runtime conditions to reliably read useful data, and may use the leaked memory (e.g., addresses or secrets) to strengthen a separate privilege-escalation chain. No public exploit code has been identified at time of analysis.