Windows Direct Composition CVE-2026-85906

Exploitation requires the attacker to already have local, authenticated low-privilege code execution on the target host (CVSS PR:L, AV:L) - this is a post-foothold escalation, not a remote entry point. The specific trigger is interaction with the Windows Direct Composition (dcomp) subsystem to drive a use-after-free (CWE-416); no special non-default configuration is called out, as Direct Composition is a standard graphics/compositing component present on all affected Windows 10/11 and Server 2022/2025 builds. Limiting factors that reduce real-world risk: the attacker must first achieve local execution, the flaw is not remotely reachable over the network, and fully-patched systems at or above the fixed builds (e.g., 10.0.26100.9711 for 24H2, 10.0.19044.7807 for 10 21H2/22H2, 10.0.20348.5761 for Server 2022) are not affected. No user interaction is required once local access is held (UI:N).

This is a credible, patch-now local privilege escalation rather than a high-CVSS-but-low-risk theoretical issue, but it is not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact within the same security scope - the classic profile of a sandbox-escape / local admin-SYSTEM elevation primitive. The CWE-416 use-after-free in Direct Composition is a memory-corruption class that is historically very amenable to reliable exploitation on Windows. However, exploitation-pressure signals are currently absent: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The key conflict to note is the 'Denial Of Service' tag versus the CVSS impact triad of C:H/I:H/A:H: the metrics describe an elevation-of-privilege/code-execution outcome, not merely a crash, so treat this primarily as an EoP. Missing data to be explicit about: EPSS probability is unknown, and because Microsoft (secure@microsoft.com) is the reporter with a patch already available, this most likely reflects internally/coordinated discovery rather than observed in-the-wild abuse - but that cannot be confirmed from the input.

A local attacker who already has a foothold with standard low-privileged code execution (e.g., a logged-in user, a compromised service account, or a browser/renderer sandbox) triggers a use-after-free in the Windows Direct Composition component to corrupt kernel/privileged memory and elevate to SYSTEM. No user interaction is required and attack complexity is low, making it a strong post-compromise escalation step. No public exploit code is identified at time of analysis.