What is the CVSS score of EUVD-2026-22473?

EUVD-2026-22473 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Desktop Window Manager are affected by EUVD-2026-22473?

A privilege escalation vulnerability in Windows Desktop Window Manager affects Windows 10, 11, and Server 2022, allowing authenticated local users with low privileges to gain SYSTEM-level access…. A patch is available.

How to fix or mitigate EUVD-2026-22473?

Within 24 hours: Identify all Windows 10 (21H2/22H2), Windows 11 (22H3/23H2), and Windows Server 2022 systems in your environment. Within 7 days: Apply vendor-released patch through your patch management process; prioritize servers and high-value workstations. Within 30 days: Verify patch deployment across 100% of affected systems via compliance scanning.

Desktop Window Manager EUVD-2026-22473

| CVE-2026-27924 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:16 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22473

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

AnalysisAI

Desktop Window Manager (DWM) in Windows 10 21H2/22H2, Windows 11 22H3/23H2, and Windows Server 2022 allows authenticated local attackers with low privileges to elevate to SYSTEM via a use-after-free memory corruption flaw. CVSS 7.8 (High). Vendor-released patch available. No public exploit identified at time of analysis, though EPSS data not provided. This is a post-authentication escalation requiring initial local foothold, not a remote intrusion vector.

Technical ContextAI

The Desktop Window Manager (dwm.exe) is the Windows compositor responsible for rendering the desktop UI, visual effects, and window management since Windows Vista. This CWE-416 use-after-free vulnerability occurs when DWM improperly handles memory lifecycle, allowing a pointer to be dereferenced after the referenced object has been freed. Exploitation requires local code execution and low-privilege credentials (PR:L per CVSS vector). Affected versions span Windows 10 builds 19044/19045, Windows 11 build 22631, and Windows Server 2022 builds 20348/25398, as confirmed by CPE strings. DWM runs with SYSTEM privileges, making it a high-value target for privilege escalation once an attacker has established initial access through other means (phishing, social engineering, or chained vulnerabilities).

RemediationAI

Apply Microsoft's security updates immediately via Windows Update or WSUS/SCCM. Fixed versions: Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later. No workarounds published; patching is the only mitigation. Prioritize systems exposed to untrusted local users (shared workstations, terminal servers, jump hosts). Verify patch deployment through enterprise management tools and validate build numbers post-reboot. Full remediation guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27924.