Windows DWM CVE-2026-85854

Exploitation requires the attacker to already possess local access and low-level (non-elevated) privileges on the target host - this is a local privilege-escalation primitive (AV:L/PR:L), not remotely reachable. The use-after-free in the Windows DWM Core Library must be triggered through local interaction with the Desktop Window Manager graphics subsystem, and the high attack complexity (AC:H) indicates a race condition or precise heap/timing state the attacker must reliably win, which limits reliability and rules out trivial one-shot exploitation. No user interaction is needed (UI:N). The chief limiting factors are the pre-required local foothold and the difficult-to-win race window; the affected product is any unpatched supported Windows build below the fixed versions listed (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650).

This is a genuine but moderate-priority elevation-of-privilege flaw rather than a drop-everything emergency. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U) reflects meaningful tempering factors: the attacker must already have local access and low-level privileges (PR:L) on the host, and exploitation is rated high-complexity (AC:H), implying a race condition or specific timing/heap-state window typical of use-after-free (CWE-416) bugs. Offsetting this, the impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with kernel/graphics-subsystem privilege escalation. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active exploitation or weaponization - the real-world exploitation likelihood signal is currently weak. No SSVC decision data (automatable/exploitation/technical-impact) was provided. In practice this is a classic second-stage local EoP: valuable to an attacker who already has a foothold (e.g., post-phishing or post-RCE) to escalate to SYSTEM, but not remotely reachable and not trivially exploitable. Prioritize patching on multi-user, shared, or high-value hosts; it is lower urgency than a network-facing unauthenticated flaw.

An attacker who has already gained low-privileged local code execution (for example via a phishing payload or a compromised standard user account) runs a crafted program that manipulates the Windows DWM Core Library into a use-after-free condition. By winning the required race/timing window (AC:H), they reclaim the freed object to corrupt memory and execute code at elevated privilege. No public exploit code is identified in the provided data, so a working exploit would require independent development against the race condition.