Windows DWM Core Library EUVD-2026-35754

The attacker must hold an authenticated local session on the target Windows 11 26H1 system with at minimum standard user privileges, as confirmed by the CVSS vector (PR:L - low privileges required). No user interaction from a second party is needed (UI:N), and exploitation complexity is low (AC:L), meaning no race conditions or special system states are required beyond the authenticated session. Exploitation is constrained to Windows 11 version 26H1 builds prior to 10.0.28000.2269. The scope is unchanged (S:U), so the vulnerability cannot cross privilege boundaries to affect other components or users directly. Exploitation is further limited by the impact ceiling: confidentiality only (I:N/A:N), with no direct code execution or system modification possible through this primitive alone. Remote attackers without an existing authenticated session on the host cannot exploit this vulnerability.

The CVSS score of 5.5 (Medium) reflects a locally-constrained vulnerability with high confidentiality impact but zero integrity or availability impact (C:H/I:N/A:N), materially limiting its standalone severity. The local attack vector (AV:L) requires the attacker to already hold an authenticated session, substantially narrowing the threat surface relative to network-exploitable issues. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning exploitation does not depend on race conditions or social engineering once local access is established. EPSS data was not provided, so exploitation probability cannot be quantified from base rates. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified, further deprioritizing urgency. The primary real-world risk is chaining: DWM runs in a privileged context, and heap memory leaks can expose memory layout data useful for ASLR bypass in multi-stage privilege escalation chains. The CWE-122 vs. out-of-bounds-read discrepancy is a data quality concern - if this is actually a write primitive rather than a read, the impact and priority assessment would increase significantly and should be re-evaluated against the vendor advisory.

An authenticated local user - such as a standard domain user with an interactive or Remote Desktop session - submits a crafted input to the DWM Core Library that triggers an out-of-bounds read from a heap-allocated buffer. The attacker reads adjacent heap memory, potentially recovering sensitive data such as memory layout addresses, session credentials, or cryptographic material resident in the DWM process heap. No public exploit code has been identified at time of analysis; the scenario assumes direct local session access as the entry point.