Windows Direct Composition EUVD-2026-100038

Exploitation requires the attacker to already have local, authenticated low-privileged access to the target Windows system (PR:L, AV:L) and the ability to run code that invokes the Direct Composition (DirectComposition/dcomp) graphics subsystem - this is reachable from a standard, unprivileged user session on default Windows installations, so no special feature toggle or non-default configuration is needed. Limiting factors: there is no remote vector (the attacker must first gain a foothold on the host), and no user interaction by a victim is required; the flaw affects the enumerated Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016/2019/2022/2025 builds below the patched versions listed in the EUVD data, so fully patched systems are not exposed.

This is a genuine but not emergency-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have local, low-privileged code execution (PR:L, AV:L) before exploiting it, which caps real-world urgency compared to a remote unauthenticated bug. Attack complexity is low and no user interaction is needed, so once an attacker has a foothold, exploitation is straightforward and yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - the classic SYSTEM-level escalation outcome expected of a Windows kernel/graphics-subsystem overflow. No EPSS score was supplied, so exploitation probability cannot be quantified. KEV status is NOT present in the input, so there is no evidence of active exploitation, and no POC was provided - meaning this is a patch-on-normal-Patch-Tuesday-cadence item rather than a drop-everything KEV emergency. The signals are internally consistent (local vector matches the 'elevate privileges locally' description); the main caveat is that LPE bugs of this type are frequently chained into exploit kits after disclosure, so despite the absence of a current POC, defenders should treat it as likely to be weaponized over time.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious document, or a compromised user account - runs a crafted program that triggers the heap-based buffer overflow in the Direct Composition component. Successful exploitation corrupts heap memory to hijack execution flow and elevate from the standard user context to SYSTEM. No public exploit code was identified at the time of analysis, but this class of Windows graphics-subsystem LPE is commonly incorporated into post-exploitation toolkits.