EUVD-2026-29626
GHSA-4rpc-r652-cgm2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with low privileges sufficient to trigger DWM OOB read; pure information disclosure with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library exposes memory contents to a locally authenticated attacker on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. The flaw carries a CVSS score of 5.5 with high confidentiality impact but no integrity or availability consequence, making it a pure information disclosure primitive. No public exploit code has been identified and CISA SSVC marks exploitation status as none, with EPSS at 0.04% (11th percentile), indicating very low near-term exploitation probability.
Technical ContextAI
The Desktop Window Manager (DWM) is the Windows compositing engine responsible for rendering the visual interface, hardware-accelerated window drawing, and effects such as transparency and animations. CWE-125 (Out-of-Bounds Read) indicates the root cause is a memory safety flaw where DWM reads beyond the intended buffer boundary, potentially leaking heap or stack memory contents to the calling process. CPE data confirms the affected scope is limited to Microsoft Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2025 including Server Core installations - notably excluding older Windows 10 and pre-2025 server releases. The local attack vector implies the vulnerability is triggered through interaction with the DWM service from a local session context, consistent with how DWM exposes APIs to user-mode processes.
RemediationAI
Apply the vendor-released patch via Windows Update or WSUS targeting the following minimum build versions: Windows 11 24H2 - build 10.0.26100.8457 or later; Windows 11 25H2 - build 10.0.26200.8457 or later; Windows 11 26H1 - build 10.0.28000.2113 or later; Windows Server 2025 and Server Core - build 10.0.26100.32860 or later. The Microsoft patch is referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35419. No workaround bypassing the patch is documented. If immediate patching is not feasible, restricting interactive local logon to only trusted administrators reduces the pool of potential exploiters, though this trades operational access for marginal risk reduction on what is already a low-probability exploitation scenario.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today