EUVD-2026-35753
GHSA-9v4q-pmfw-6hgx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated low-privilege attacker to gain higher privileges through a use-after-free memory corruption flaw. The vulnerability carries a CVSS score of 7.8 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess local code execution on the target Windows host as a low-privileged authenticated user (CVSS PR:L, AV:L), and the affected DWM Core Library component must be loaded - which is the default state on any interactive Windows desktop session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a locally-exploitable issue requiring low attacker privileges, no user interaction, and yielding full CIA impact - a classic local elevation-of-privilege profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained a low-privileged shell on a Windows host - for example via phishing-delivered malware, a compromised service account, or a malicious insider - executes a crafted program that interacts with DWM in a sequence that triggers the use-after-free, sprays the freed allocation with attacker-controlled data, and pivots execution into the DWM process to elevate to SYSTEM. With SYSTEM privileges the attacker can disable security tooling, dump LSASS for credentials, and establish persistence. … |
| Remediation | Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44802 during the next Patch Tuesday cycle; patch status from the supplied data is best characterized as Patch available per vendor advisory, with specific KB numbers and build versions to be confirmed against the MSRC update guide for each affected Windows SKU. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of Windows systems in the environment; disable or restrict non-essential user logons on critical business systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today