Windows DWM Core Library EUVD-2026-35749

Attacker must already have authenticated low-privileged code execution on the target Windows host (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained exploitation is straightforward against an unpatched DWM Core Library. Limiting factors: cannot be triggered across the network, requires a valid local logon session, and is constrained to Windows builds shipping the vulnerable DWM Core Library version listed in the MSRC advisory.

Signals are mixed but lean toward moderate priority. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) confirms local access with low-privileged authentication required, no user interaction, and total impact - typical of post-compromise privilege escalation chains used after phishing or initial foothold. However, CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', indicating no observed in-the-wild activity, and no public exploit identified at time of analysis. EPSS data was not supplied in the input, so probabilistic exploitation likelihood cannot be quantified. This is a credible privilege-escalation primitive against a high-value Windows component, but not an emergency unless paired with active exploitation reporting from Microsoft's MSRC advisory; verify against the MSRC update guide for any change in exploitation status.

An attacker who has obtained low-privileged code execution on a Windows host - for example via a phishing payload, a compromised RDP account, or a malicious insider session - triggers the use-after-free condition in the DWM Core Library through crafted graphics or compositor API calls, grooms the freed allocation, and gains SYSTEM-level execution. From there the attacker disables endpoint defenses, dumps LSASS for credential theft, and pivots laterally. No public exploit identified at time of analysis, so this scenario is theoretical and grounded in the CVSS local-vector profile.