EUVD-2026-35752
GHSA-c6qj-462h-v9wg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) Core Library enables an authenticated low-privileged attacker to gain elevated privileges through a use-after-free memory corruption flaw. CVSS 7.8 reflects high impact on confidentiality, integrity, and availability but requires local access and existing user-level credentials. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The Desktop Window Manager (DWM) is a core Windows compositing engine that manages window rendering, visual effects, and GPU-accelerated drawing for the desktop shell. The DWM Core Library runs with elevated privileges and is reachable from lower-privileged user sessions, making it a recurring target for local elevation of privilege research. CWE-416 (Use After Free) describes memory corruption where freed heap objects are referenced again, allowing an attacker who can control the reallocated memory contents to hijack control flow, corrupt kernel/user state, or pivot to SYSTEM-level execution depending on the exploited object's role.
RemediationAI
Apply the Microsoft-released security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42983 - the patch is available from the vendor, and exact KB/build numbers for each affected Windows SKU should be retrieved from that page and deployed through Windows Update, WSUS, Intune, or your standard patch-management pipeline. Because the issue requires local authenticated access, compensating controls while patching include restricting interactive and RDP logon rights on sensitive hosts to trusted administrators (limits the PR:L attacker pool but disrupts shared-workstation and helpdesk workflows), enforcing application allowlisting via WDAC or AppLocker to block unsigned local binaries that would deliver the exploit (high deployment effort and may break legitimate tooling), and prioritizing patches on multi-tenant systems such as Citrix, AVD, and RDS hosts where the local-attacker assumption is most realistic.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today