Windows DWM Core CVE-2026-83765

Exploitation requires the attacker to already have local, interactive code-execution as an authenticated low-privileged user on the target Windows host (CVSS PR:L, AV:L) - there is no remote or network-facing path and no user interaction is needed (UI:N). The attacker must be able to run or inject code that drives the Desktop Window Manager (DWM) Core Library into the vulnerable out-of-bounds read; DWM is enabled by default on supported Windows client and server builds, so no special non-default configuration is required beyond having a session on the machine. Limiting factors: the need for an existing authenticated local foothold, the confidentiality-only outcome (no direct integrity or availability impact, S:U so no scope change), and the non-automatable local vector, which together prevent remote mass exploitation and make this most relevant on shared, multi-user, or remote-desktop hosts where untrusted users have local sessions.

This is a genuine-but-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-complexity, low-privilege information-disclosure flaw with high confidentiality impact but no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) in the Windows DWM Core Library. CISA's SSVC framework reinforces the lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (local attack vector cannot be mass-scanned/wormed), and Technical Impact=partial. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; absence of an EPSS figure is a data gap, not evidence of low risk. The CVE is NOT in CISA KEV and no public proof-of-concept is indicated, so this is 'no public exploit identified at time of analysis.' Net assessment: a real, patch-worthy vulnerability that is realistically a second-tier priority - the requirement for local, authenticated access and the confidentiality-only impact (likely a memory-disclosure primitive useful for defeating ASLR/KASLR or leaking sensitive data, rather than direct code execution) keep real-world risk well below that of a remote unauthenticated flaw. Prioritize via normal Patch Tuesday cadence, with elevated attention on multi-user/shared and RDP-style hosts where a low-privileged attacker already has a foothold.

A low-privileged but authenticated local user (or an attacker who has already gained a foothold via phishing or another bug) runs a crafted application that interacts with the Desktop Window Manager, triggering an out-of-bounds read in the DWM Core Library and leaking adjacent process/kernel memory. The disclosed memory can reveal sensitive data or defeat address-space layout randomization, serving as a building block in a larger local privilege-escalation chain. No public exploit code is identified at time of analysis, and the local attack vector means it cannot be exploited remotely or at scale.