What is the CVSS score of EUVD-2026-22472?

EUVD-2026-22472 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Desktop Window Manager are affected by EUVD-2026-22472?

CVE-2026-27923 is a privilege escalation vulnerability in Windows Desktop Window Manager affecting Windows 10, Windows 11, and Server 2012-2025, allowing authenticated local users to gain…. A patch is available.

How to fix or mitigate EUVD-2026-22472?

Within 24 hours: Inventory all Windows 10, 11, and Server 2012-2025 systems in your environment and identify patch availability for your specific versions from Microsoft Security Updates. Within 7 days: Deploy vendor patches to non-production systems and conduct testing to validate stability and application compatibility. Within 30 days: Complete patching of all production Windows systems, prioritizing multi-user environments (RDS/terminal servers, shared workstations, and lab systems) where local user elevation risk is highest.

Desktop Window Manager EUVD-2026-22472

| CVE-2026-27923 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

GHSA-2h4c-cjph-5cr5

Denial Of Service Use After Free Memory Corruption

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:30 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22472

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

AnalysisAI

Desktop Window Manager (DWM) use-after-free memory corruption allows authenticated local attackers to escalate privileges to SYSTEM on all supported Windows 10, Windows 11, and Windows Server versions (2012-2025). The vulnerability enables low-privileged users to gain complete control over affected systems with low attack complexity and no user interaction required. Vendor-released patches are available across all affected versions. No public exploit identified at time of analysis, though the st

Technical ContextAI

Desktop Window Manager (DWM) is the Windows compositing window manager responsible for visual effects, desktop composition, and window rendering since Windows Vista. This use-after-free vulnerability (CWE-416) occurs when DWM incorrectly manages memory object lifecycles, allowing a pointer to reference already-freed memory. The affected component spans the entire supported Windows ecosystem: Windows 10 versions 1607 through 22H2 (builds 10.0.14393.x to 10.0.19045.x), Windows 11 versions 22H3 through 26H1 (builds 10.0.22631.x to 10.0.28000.x), and Windows Server editions from 2012 (6.2.9200.x) through 2025 (10.0.26100.x) including Server Core installations. Use-after-free flaws enable attackers to manipulate freed memory regions to redirect program execution, typically achieved by triggering specific sequences of window manager operations that cause premature memory deallocation while retaining dangling pointers. In privileged system services like DWM running with SYSTEM-level permissions, successful exploitation converts low-privileged local access into complete administrative control.

RemediationAI

Apply the vendor-released security updates immediately from Microsoft Security Response Center. Update Windows 10 version 21H2 to build 10.0.19044.7184 or later, Windows 10 version 22H2 to build 10.0.19045.7184 or later, Windows 10 version 1809 to build 10.0.17763.8644 or later, and Windows 10 version 1607 to build 10.0.14393.9060 or later. For Windows 11, update version 22H3 and 23H2 to build 10.0.22631.6936 or later, version 24H2 to build 10.0.26100.32690 or later, version 25H2 to build 10.0.26200.8246 or later, and version 26H1 to build 10.0.28000.1836 or later. Windows Server 2012 requires build 6.2.9200.26026 or later, Server 2012 R2 requires 6.3.9600.23132 or later, Server 2016 requires 10.0.14393.9060 or later, Server 2019 requires 10.0.17763.8644 or later, Server 2022 requires 10.0.20348.5020 or later (or 10.0.25398.2274 for 23H2 Edition), and Server 2025 requires 10.0.26100.32690 or later. Patches are delivered through Windows Update, WSUS, or Microsoft Update Catalog. No effective workarounds exist; patching is the only remediation. Full advisory details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27923.