Windows DWM Core EUVD-2026-35748

The attacker must already have local, authenticated access to the target Windows host with at least low-privileged user rights (PR:L) and the ability to execute code or call graphics APIs that reach the vulnerable DWM Core Library code path; no user interaction is required (UI:N) and the attack runs entirely on the local machine (AV:L), so it cannot be triggered directly from the network. Exploitation is limited by the need for prior code execution on the box, by mitigations such as HVCI/Credential Guard that constrain kernel-adjacent memory corruption, and by the requirement that the targeted Windows build ships the unpatched dwmcore.dll enumerated in the MSRC advisory.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the attacker must already be authenticated locally with low privileges but requires no user interaction and faces low attack complexity, making this a strong candidate for chaining after initial access (phishing, browser exploit, malware drop). There is no CISA KEV entry and no public POC referenced, so this is currently a theoretical-but-credible threat rather than a confirmed in-the-wild campaign - EPSS data was not provided. DWM EoP bugs have historically been exploited by ransomware and APT operators once details emerge, so the practical priority for managed Windows fleets is high despite the lack of active exploitation signal. No conflicting signals between CVSS and description were identified.

An attacker who has already obtained a standard user shell on a Windows endpoint - for example via a phishing payload or a compromised browser session - triggers the vulnerable DWM code path with a crafted sequence of graphics or window-management calls, reclaims the freed heap object with attacker-controlled data, and executes code in the higher-privileged DWM context to escalate to SYSTEM. From there the operator disables endpoint defenses, dumps LSASS, and pivots laterally. No public exploit identified at time of analysis.