Windows Direct Composition CVE-2026-70021

Requires the attacker to already have local, low-privileged authenticated code execution on the target (PR:L, AV:L) - this is not remotely reachable. Exploitation specifically targets the Windows Direct Composition component and, as a CWE-416 use-after-free with AC:H, depends on winning a timing/race window and grooming the heap so the freed object is reused with attacker-controlled data, making reliable exploitation difficult. No user interaction is needed (UI:N). Limiting factors: no network vector, mandatory prior local access, and high attack complexity; it is present by default wherever the affected Windows builds run but still demands an existing foothold to be useful.

This is a moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated access (PR:L) and must win a race or satisfy specific heap-state conditions typical of use-after-free bugs (AC:H), which materially lowers reliable exploitability. The 7.0 score is driven almost entirely by the total technical impact (C:H/I:H/A:H), corroborated by SSVC 'Technical Impact: total' - successful exploitation yields SYSTEM-level control. Crucially, the exploitation signals point AWAY from urgency: SSVC 'Exploitation: none' and 'Automatable: no', no CISA KEV listing, and no public exploit code identified. There is a signal conflict worth noting: the input Tags include 'Denial Of Service' yet the CVSS maps A:H and the CWE is a privilege-escalation UAF - the DoS framing likely reflects one possible outcome of the memory corruption rather than the primary impact; treat EoP as the real risk. Bottom line: a credible SYSTEM-level EoP primitive useful as a second-stage in a chain, but high attack complexity plus no observed exploitation make it a patch-on-cycle item rather than an immediate fire.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted local program that manipulates Direct Composition objects to trigger the use-after-free. By winning the race condition and controlling the freed-then-reused memory, they corrupt kernel/graphics state to execute code at SYSTEM. No public proof-of-concept exists at the time of analysis, and the high attack complexity means exploitation is not reliably repeatable.