Windows DWM Core Library EUVD-2026-35753

Exploitation requires the attacker to already possess local code execution on the target Windows host as a low-privileged authenticated user (CVSS PR:L, AV:L), and the affected DWM Core Library component must be loaded - which is the default state on any interactive Windows desktop session. No user interaction is needed (UI:N), so no phishing or click-through is required once local access is obtained. The vulnerability is NOT remotely reachable over the network and cannot be triggered from an unauthenticated context; headless Server Core installations without the desktop shell, and accounts denied interactive logon, are not realistically exposed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a locally-exploitable issue requiring low attacker privileges, no user interaction, and yielding full CIA impact - a classic local elevation-of-privilege profile. No EPSS score, KEV listing, or SSVC decision is provided in the input, so probabilistic exploitation likelihood cannot be quantified. There is no public exploit identified at time of analysis and the bug is not on CISA KEV; however, DWM use-after-free flaws have historically been weaponized post-disclosure as second-stage LPE primitives in malware and red-team toolchains, so real-world risk should be treated as elevated for any multi-user, kiosk, or initial-foothold scenario despite the lack of confirmed in-the-wild activity. No conflicting signals were observed in the supplied data, but the absence of EPSS/KEV/POC fields means exploitation maturity is genuinely unknown rather than confirmed-low.

An attacker who has already obtained a low-privileged shell on a Windows host - for example via phishing-delivered malware, a compromised service account, or a malicious insider - executes a crafted program that interacts with DWM in a sequence that triggers the use-after-free, sprays the freed allocation with attacker-controlled data, and pivots execution into the DWM process to elevate to SYSTEM. With SYSTEM privileges the attacker can disable security tooling, dump LSASS for credentials, and establish persistence. No public exploit identified at time of analysis, but DWM UAF bugs are a well-known LPE primitive class.