Windows DWM Core CVE-2026-88177

Requires the attacker to already have local, authenticated, low-privileged code execution on the target Windows host (PR:L/AV:L); they then invoke the Desktop Window Manager (DWM) Core Library code path that performs the out-of-bounds read. No user interaction and no special or non-default configuration is required - DWM Core is a standard component present on all supported Windows client and server builds. The principal limiting factor is the need for an existing local foothold: this cannot be exploited remotely or by an unauthenticated attacker, making it a post-compromise privilege-escalation primitive rather than an initial-access vector.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it is locally exploitable by an attacker who already holds low-level (authenticated) privileges, with low attack complexity and no user interaction, yielding high confidentiality, integrity, and availability impact (base score 7.8). Signals largely agree that this is NOT an urgent emergency: CISA SSVC rates Exploitation as 'none' and Automatable as 'no', though Technical Impact is 'total', consistent with full privilege gain. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. The practical consequence is that this is a second-stage flaw - valuable to an attacker who already has a foothold on the host, not a remote entry point. One notable internal tension: the CWE is CWE-125 (out-of-bounds read), which normally implies a confidentiality/information-disclosure outcome, yet the vector asserts C:H/I:H/A:H and the description frames it as privilege elevation; this reflects Microsoft's standard practice of scoring an info-leak that enables EoP at full impact - treat the I:H/A:H as derived from the resulting privilege gain rather than a direct write primitive, and verify with the MSRC advisory.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted process that triggers the out-of-bounds read in the DWM Core Library to leak memory and escalate to SYSTEM. No user interaction is required. No public exploit code is currently identified, so this would require original exploit development.