Windows DWM CVE-2026-88180

Requires the attacker to already execute code as an authenticated local user on the Windows host (AV:L, PR:L) - there is no remote or network-facing attack surface and no exploitation against external interfaces. The Desktop Window Manager (DWM) Core Library is present and running by default on all supported Windows client and server installations (including Server Core builds per the EUVD list), so no non-default feature or configuration must be enabled. Limiting factors: the attacker must first obtain local low-privileged code execution, exploitation is per-host and not automatable (SSVC Automatable=no), and hosts patched to the fixed builds (e.g. Windows 11 24H2 ≥10.0.26100.9711, Server 2022 ≥10.0.20348.5761, Server 2019/Win10 1809 ≥10.0.17763.9376) are not affected.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows DWM Core Library. The signals are largely consistent and point to a real-but-not-emergency priority. The CVSS vector requires local access and existing low privileges (AV:L, PR:L), so this is not a remotely-wormable bug; it is a post-compromise privilege-escalation primitive. CISA's SSVC assessment reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with AV:L requiring an existing foothold and per-target interaction), but Technical Impact=total (consistent with the C:H/I:H/A:H full-impact rating of a SYSTEM-level EoP). There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so there is no public exploit identified at time of analysis. One nuance to verify: the root cause is an out-of-bounds READ (CWE-125), which most naturally yields information disclosure (memory leak), yet Microsoft rates full C:H/I:H/A:H - this is typical for Windows DWM EoP bugs where a memory-disclosure primitive is chained to achieve SYSTEM, but the I:H/A:H impact is Microsoft's assessment of the exploitable outcome rather than a direct consequence of a read alone. Overall: a legitimate patch-soon EoP for any multi-user or endpoint-hardening context, but not an internet-facing drop-everything item given the local vector and absence of exploitation evidence.

An attacker who already has a low-privileged foothold on a Windows host (via phishing, a prior RCE, or a standard user account) runs a crafted program that triggers the out-of-bounds read in the DWM Core Library to corrupt or leak memory and escalate to SYSTEM. No user interaction is required (UI:N), but local code execution as an existing user is a prerequisite. No public exploit code has been identified at time of analysis, so weaponization would require independent development.