Windows Direct Composition CVE-2026-83903

Exploitation requires the attacker to already possess local, authenticated low-privilege access (PR:L) to a vulnerable Windows host - this is a post-compromise privilege-escalation primitive, not a remote entry point (AV:L). The affected component is the Windows Direct Composition graphics subsystem, present by default in Windows 11 (24H2, 25H2, 26H2) and Windows Server 2025 (including Server Core), so no special non-default configuration or feature toggle is needed. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the prerequisite local foothold: an attacker with no access to the machine cannot use this flaw directly, which bounds its real-world risk despite the HIGH score.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have local, low-privilege code execution on the host, but once there, exploitation is low-complexity, needs no user interaction, and yields total compromise (C:H/I:H/A:H) - consistent with SSVC 'Technical Impact: total'. These signals align with each other and are not contradictory. However, exposure-side signals point to lower immediacy: SSVC 'Exploitation: none' and the absence of any CISA KEV listing or published POC mean there is no public exploit identified at time of analysis, and SSVC 'Automatable: no' indicates it cannot be reliably mass-exploited (expected for a local heap overflow requiring a prior foothold). No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be factored in - treat that as a gap. Net: a real second-stage escalation primitive valuable in a post-compromise chain, worthy of normal patch-cycle prioritization across the Windows fleet, but not a drop-everything issue given no active exploitation and no automatability.

An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing, a malicious application, or a compromised standard user account) invokes the Direct Composition component with crafted input that triggers a heap-based buffer overflow. By corrupting heap structures to hijack control flow, the attacker elevates from the standard user context to SYSTEM. No user interaction is required and attack complexity is low, but no public exploit code has been identified at the time of analysis.