EUVD-2026-35748
GHSA-83gr-6443-3q7q
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library stems from a use-after-free condition (CWE-122) that lets an authenticated low-privileged user gain elevated rights on affected Windows systems. The flaw was reported by Microsoft (secure@microsoft.com) and tracked via MSRC, with no public exploit identified at time of analysis and no CISA KEV listing. CVSS 7.8 reflects high impact on confidentiality, integrity, and availability once the attacker has local foothold.
Technical ContextAI
The Desktop Window Manager (dwm.exe and its supporting Core Library, dwmcore.dll) is the compositing window manager that renders the Windows desktop, handling visual effects, transparency, and surface composition across user sessions. CWE-122 here is classified as a heap-based memory corruption issue and the description identifies it as a use-after-free: a heap object referenced by DWM is freed but a dangling pointer is later dereferenced, allowing an attacker to influence the contents of the reused allocation. Because DWM components historically run with higher privileges than the calling user session, corrupting their heap state is a recognized vector for crossing privilege boundaries on Windows. The advisory tags (Buffer Overflow, Heap Overflow, Denial Of Service) align with this memory-safety class.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44808 through Windows Update, WSUS, or your enterprise patch management platform; exact fix KB numbers should be taken from that advisory for each Windows SKU you operate. No vendor-published workaround is listed, and disabling DWM is not a supported configuration on modern Windows, so compensating controls are limited to reducing local foothold risk: enforce least-privilege on interactive users, require LAPS-managed local admins, enable Credential Guard and HVCI to make post-exploitation harder, and restrict the ability of low-privileged users to run untrusted binaries via AppLocker or WDAC, accepting the operational overhead of application allowlisting.
More in Windows 11 26h1
View allRemote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
BitLocker's protection mechanism on Windows fails to enforce a critical authentication or verification step, permitting
Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive e
Denial-of-service in the Windows TCP/IP stack allows an authenticated attacker on an adjacent network to crash the netwo
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables a locally authenticated
Windows Push Notifications on multiple Windows 10, Windows 11, and Windows Server versions exposes sensitive memory cont
Windows Push Notifications contains a use-of-uninitialized-resource flaw (CWE-200) that enables authenticated local atta
Remote tampering in Microsoft Windows DHCP Server allows unauthenticated network attackers to manipulate critical data w
Privilege escalation in Windows Telephony Service through heap buffer overflow affects Windows 10 1607, Windows 11 25h2,
Remote code execution in Microsoft Remote Desktop Client occurs when a user connects to an attacker-controlled RDP serve
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today