EUVD-2026-22473Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Desktop Window Manager (DWM) in Windows 10 21H2/22H2, Windows 11 22H3/23H2, and Windows Server 2022 allows authenticated local attackers with low privileges to elevate to SYSTEM via a use-after-free memory corruption flaw. CVSS 7.8 (High). Vendor-released patch available. No public exploit identified at time of analysis, though EPSS data not provided. This is a post-authentication escalation requiring initial local foothold, not a remote intrusion vector.
Technical ContextAI
The Desktop Window Manager (dwm.exe) is the Windows compositor responsible for rendering the desktop UI, visual effects, and window management since Windows Vista. This CWE-416 use-after-free vulnerability occurs when DWM improperly handles memory lifecycle, allowing a pointer to be dereferenced after the referenced object has been freed. Exploitation requires local code execution and low-privilege credentials (PR:L per CVSS vector). Affected versions span Windows 10 builds 19044/19045, Windows 11 build 22631, and Windows Server 2022 builds 20348/25398, as confirmed by CPE strings. DWM runs with SYSTEM privileges, making it a high-value target for privilege escalation once an attacker has established initial access through other means (phishing, social engineering, or chained vulnerabilities).
RemediationAI
Apply Microsoft's security updates immediately via Windows Update or WSUS/SCCM. Fixed versions: Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later. No workarounds published; patching is the only mitigation. Prioritize systems exposed to untrusted local users (shared workstations, terminal servers, jump hosts). Verify patch deployment through enterprise management tools and validate build numbers post-reboot. Full remediation guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27924.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today