Windows DWM CVE-2026-88128

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the target Windows host (PR:L, AV:L) - this is a second-stage escalation, not a remote entry point. Once local access is held, no special configuration, feature flag, or user interaction is needed (AC:L/UI:N): the Desktop Window Manager (DWM) Core Library is a core, always-present component of every supported Windows client and server edition, so default installations are affected. The primary limiting factor is the prerequisite foothold; the vulnerability cannot be reached directly over a network and cannot be automated at scale (SSVC Automatable: no).

This is a moderate-priority local privilege escalation. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates an attacker who already has local, low-privileged access can reliably (low complexity, no user interaction) achieve total compromise of confidentiality, integrity, and availability on the affected host. CISA's SSVC framework aligns with a measured view: Exploitation is 'none' (no observed active exploitation), Automatable is 'no' (consistent with a local-only, post-access vector that cannot be sprayed across the internet), while Technical Impact is 'total' (consistent with the full C/I/A compromise in the vector). There is no CISA KEV listing and no EPSS score was supplied; no public exploit is indicated. The signals are therefore internally consistent and point to a dangerous-but-not-yet-exploited bug: the ceiling of impact is high, but the requirement for pre-existing local access and the 'Automatable: no' / 'Exploitation: none' assessment mean this is not a mass-exploitation threat today. It is a standard second-stage privilege-escalation primitive (attacker lands via phishing/malware, then uses this to gain SYSTEM), so it should be prioritized in routine Patch Tuesday remediation rather than treated as an emergency. Note: no EPSS probability was provided in the input, so near-term exploitation likelihood cannot be numerically quantified.

An attacker who has already gained low-privileged code execution on a Windows machine (e.g., via a phishing payload or a compromised standard user account) triggers the heap-based buffer overflow in the DWM Core Library to corrupt memory and elevate to SYSTEM. No user interaction is required and attack complexity is low, making it a reliable local escalation step. No public exploit code is identified at time of analysis, but DWM is a historically common EoP target.