Windows Server 2012 EUVD-2026-22472

Local user account required on target system running Windows Desktop Window Manager; attacker must have ability to execute code within user session context.

This vulnerability presents a significant privilege escalation risk in enterprise and multi-user Windows environments. The CVSS 3.1 score of 7.8 (High) accurately reflects the severe impact when exploited: the attack vector is local (AV:L) requiring authenticated access (PR:L), but attack complexity is low (AC:L) with no user interaction needed (UI:N), resulting in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The unmodified scope (S:U) indicates the vulnerability remains within DWM's security context, though escalation to SYSTEM effectively breaks Windows security boundaries. No public exploit code exists and the vulnerability is not listed in CISA KEV, suggesting it has not been actively exploited in the wild. However, the low complexity rating indicates exploitation development is realistic once technical details emerge. The requirement for initial authenticated access provides some risk mitigation, as attackers must first compromise a low-privileged account through other means. For organizations with robust perimeter defenses and endpoint protection, this represents a post-compromise lateral movement or persistence mechanism rather than an initial access vector. The widespread availability of vendor patches across all affected versions significantly reduces real-world risk for organizations maintaining current patch cycles. Priority should be elevated for systems with multiple user accounts, terminal servers, shared workstations, and environments where insider threats or compromised credentials are concerns.

An authenticated local user crafts specific Desktop Window Manager API calls to trigger a use-after-free vulnerability, corrupting freed memory and gaining SYSTEM-level code execution without user interaction or special configurations.