Desktop Window Manager CVE-2026-96108

Exploitation requires the attacker to already have local, authenticated access with low privileges on the target (PR:L, AV:L) - this is a privilege-escalation primitive, not an initial-access or remote vector, so it is only reachable after a foothold is established. No end-user interaction is needed (UI:N) and no special or non-default configuration is called out: Desktop Window Manager is a standard, always-present component of every affected Windows 10/11 and Windows Server 2019/2022/2025 build, so default installations within the vulnerable build ranges are exposed. The principal limiting factor is the local-access prerequisite; the practical window is any multi-user, Terminal/RDP, or post-compromise scenario where an unprivileged process can invoke DWM code paths.

This is a CVSS 7.8 (HIGH) local privilege-escalation flaw (CWE-416 use-after-free) in the Windows Desktop Window Manager (dwm.exe/win32k-adjacent graphics stack). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: AV:L and PR:L match 'an authorized attacker to elevate privileges locally,' meaning an already-authenticated low-privilege user is the starting point, not a remote unauthenticated attacker. Impact is full (C:H/I:H/A:H), consistent with achieving SYSTEM-level code execution. On real-world signals the picture is favorable to defenders: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit was referenced - so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between signals (no inflated AV:N vs. local-access language here; everything points to local EoP). The practical priority is driven not by exploitation evidence but by ubiquity and role: DWM EoP bugs are a classic post-compromise sandbox-escape / local-elevation primitive frequently chained after initial access, and Microsoft-class UAF EoPs in this component have historically been weaponized. Treat as a standard-priority Patch Tuesday elevation fix: important to patch on the normal monthly cycle, but not an emergency absent active-exploitation evidence. One caveat worth noting to analysts: the input Tags include 'Denial Of Service,' yet the description and the C:H/I:H/A:H vector characterize this as code-execution/elevation rather than a mere crash - the DoS tag likely reflects a secondary memory-corruption outcome and should not be read as the primary impact.

A local attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a malicious app, or a compromised standard user account) runs a crafted program that manipulates Desktop Window Manager objects to trigger the use-after-free, reclaiming the freed memory to hijack control flow and execute code as SYSTEM. No public proof-of-concept was identified in the provided data, and user interaction is not required (UI:N). This serves as a reliable second-stage privilege-escalation step rather than an initial-access vector.