Windows DWM CVE-2026-88189

Exploitation requires the attacker to already possess authenticated, low-privileged local code execution on the Windows host (CVSS PR:L, AV:L); there is no remote vector and no user interaction is needed (UI:N). The Desktop Window Manager Core Library is present and running by default on all affected Windows client and server editions, so no special configuration or non-default feature must be enabled - the primary limiting factor is simply that the attacker must first obtain an initial foothold as a standard user before this flaw can be used to escalate.

This is a moderate-priority local privilege-escalation flaw (CVSS 7.8, CWE-125 out-of-bounds read) in the Windows DWM Core Library. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with a local EoP: the attacker needs an existing low-privileged foothold but no user interaction, and low attack complexity means exploitation is reliable once code runs on the host. Signals converge toward a NOT-yet-urgent rating: CISA SSVC lists Exploitation='none' and Automatable='no', there is no CISA KEV listing, and no public POC is indicated - so this is not currently a mass-exploited or wormable issue. However, SSVC Technical Impact='total' matches the C:H/I:H/A:H impact and reflects that successful exploitation yields full SYSTEM-level control. Note a tension worth verifying: CWE-125 and the 'Information Disclosure' tag describe an out-of-bounds READ (a memory-disclosure primitive), yet Microsoft rates full I:H/A:H integrity and availability impact - this is typical for DWM EoP chains where an info leak defeats ASLR/KASLR to enable a follow-on write, but defenders should treat the EoP (not mere disclosure) as the real impact. Because no EPSS score was provided in the input, exploitation probability cannot be quantified here.

An attacker who has already achieved low-privileged code execution on a Windows machine (e.g., via phishing, a malicious app, or a compromised standard user account) runs a crafted process that drives the Desktop Window Manager to trigger the out-of-bounds read in the DWM Core Library, leaking kernel/privileged memory to bypass mitigations and escalate to SYSTEM. No public exploit is identified at the time of analysis, and the CVSS local vector (AV:L, no UI) means this is a post-compromise escalation step rather than an initial-access vector.