Windows Direct Composition CVE-2026-70151

The attacker must already have the ability to execute code locally on the target with at least low-level authenticated privileges (PR:L) - this is a post-compromise privilege-escalation primitive, not an initial access vector. The affected component is Windows Direct Composition (the dcomp/DWM compositing subsystem), which is present by default in supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2022/2025 builds, so no non-default feature toggle is required. The primary limiting factors are the local attack vector (AV:L, no remote reachability) and the need for a pre-existing foothold; no user interaction (UI:N) is needed once local access is held.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity elevation-of-privilege flaw requiring an attacker to already possess low-level (authenticated, non-admin) access to the host, with full C:H/I:H/A:H impact on an unchanged scope - consistent with the base score of 7.8 (High). Because the attack vector is local, this cannot be exploited remotely without a prior foothold, which meaningfully lowers real-world urgency compared to a network-reachable bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or available exploit code - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC data supplied. The signals are internally consistent (local EoP, memory-corruption class, no exploitation evidence); the main caveat is that this is a kernel/graphics-stack use-after-free in Windows, a class Microsoft EoP bugs are frequently chained into after initial access, so despite the absence of exploitation data it merits routine-to-prompt patch prioritization on a standard Patch Tuesday cadence rather than out-of-band action.

An attacker who has already gained unprivileged code execution on a Windows host (via phishing, a malicious application, or a compromised low-privilege account) runs a crafted program that manipulates Direct Composition objects to trigger the use-after-free, corrupting kernel/component memory to execute code at higher privilege. No user interaction is required once the attacker is running local code. No public exploit code has been identified, so exploitation currently requires original development effort.