EUVD-2026-35761
GHSA-j9m5-7hq3-xx6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local execution
-
DeliveryInvoke crafted graphics/window API sequence
-
ExploitTrigger UAF in DWM Core Library
-
ExecutionHeap spray to control freed object
-
PersistHijack execution at elevated integrity
-
ImpactAchieve SYSTEM-level privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already have local code execution on the target Windows host with at least low-privileged authenticated user rights (CVSS PR:L), making this a post-compromise escalation primitive rather than an initial-access vulnerability. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-only attack vector (AV:L) rules out remote network exploitation entirely. Exploitation requires the DWM Core Library to be running, which is the default on all modern Windows installations with the standard graphical desktop; headless Server Core deployments without the desktop experience installed do not load DWM and are not exposed. |
| Impact | The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low complexity, low existing privileges, and no user interaction - a classic local privilege escalation profile relevant to second-stage attacks after initial foothold. CISA SSVC contradicts the severity narrative somewhat: Exploitation is rated 'none' and Automatable is 'no', which argues against immediate mass-exploitation risk, though Technical Impact is 'total' meaning a successful exploit yields full system compromise. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV; combined with the absence of any public POC, this suggests the issue is a serious-but-currently-theoretical local EoP rather than an actively weaponized bug. DWM UAFs historically attract exploit developers for use in browser sandbox escapes and malware privilege escalation chains, so the risk profile may shift if a POC is published. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged code execution on a Windows host - for example through a phishing-delivered malware payload or by compromising a standard user account on a shared workstation - invokes a crafted sequence of graphics or windowing API calls that triggers the use-after-free in the DWM Core Library. By spraying the heap to control the freed allocation, the attacker hijacks execution within the DWM context to elevate to SYSTEM-level privileges, enabling credential theft, security tool disablement, and persistent foothold installation. No public exploit identified at time of analysis, so any current attack would require original exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables an authenticated low-privilege attacker to gain elevated rights through a use-after-free memory corruption flaw. The issue carries a CVSS 7.8 (High) rating with total confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. CISA SSVC scoring marks exploitation as 'none' and not automatable, suggesting limited real-world activity despite the severe technical impact.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44813 for your specific Windows version; exact fix KB numbers should be obtained from that advisory as they were not included in the source intelligence. Because this is a local privilege escalation, compensating controls focus on limiting initial access: enforce least-privilege user accounts (no standard users running as local admin), restrict interactive logon to trusted endpoints, deploy EDR with detections for DWM process anomalies and unusual child-process creation under dwm.exe, and prioritize patching on multi-user systems such as RDS/Citrix hosts and VDI where many low-privilege users share a host. Disabling DWM is not a viable mitigation on modern Windows because the desktop compositor is integral to the OS shell.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Desktop Window Manager (DWM) is the Windows compositing engine responsible for rendering visual effects, window thumbnails, and the graphical desktop surface; its Core Library runs with elevated rights to mediate between user-mode applications and the GPU/kernel graphics stack. The root cause is CWE-416 (Use After Free), where memory is referenced after being released - in DWM this typically arises when window or surface object lifecycles are mismanaged across compositor callbacks, allowing the freed allocation to be reclaimed with attacker-controlled data before the dangling pointer is dereferenced. Successful exploitation of such UAFs in graphics subsystems is a well-known path to controlling instruction flow at a higher integrity level.
Know when Windows 11 26h1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2026-44813 is a local privilege escalation vulnerability in Windows Desktop Window Manager that could allow low-privilege users to gain elevated system rights, potentially compromising confidentiality, integrity, and system availability. While no public exploits have been identified, the absence of a vendor patch leaves affected Windows systems exposed until remediation controls are implemented. This poses a direct risk to any organization relying on Windows workstations and requires immediate compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict application control and privilege restriction policies for low-privilege users; deploy Windows Defender Exploit Guard or equivalent control measures; implement privileged access management (PAM) solutions to restrict dangerous privilege escalation paths; monitor for suspicious elevation attempts through Windows event log auditing; conduct regular endpoint vulnerability assessments for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Windows DWM Core Library Use-After-Free EoP
View all 8More in Windows 11 26h1
View allCommand injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Exploit-DB