Windows DirectX EUVD-2026-43937

Exploitation requires the attacker to already have local, authenticated access to the target Windows host at low privilege (PR:L) and the ability to execute code that reaches the DirectX component - consistent with AV:L (local) and AC:L (low complexity), with no user interaction needed (UI:N). Limiting factors: the attacker cannot trigger this remotely or without valid credentials/a foothold, so it functions as a local privilege-escalation/code-execution step rather than an initial-access vector; the affected component is present by default across all listed Windows 10/11 and Server 2019-2025 builds, so no non-default configuration is required once local access is obtained. The exact triggering DirectX API/interface is not specified in the available data.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8, High) describes a local attack (AV:L) requiring only low privileges (PR:L) and no user interaction, with a Changed scope and total confidentiality, integrity, and availability impact - the profile of a privilege-escalation / local code-execution flaw where a low-privileged user gains high-impact control over the system. Real-world urgency is tempered by the local attack vector: the attacker must already be able to execute code as a standard authenticated user on the host, so this is a second-stage escalation primitive, not a remote entry point. No EPSS score, KEV entry, or SSVC decision data was provided; with no public exploit identified and no active-exploitation signal, immediate mass-exploitation risk appears low, but the ubiquity of DirectX and the high technical impact make this a strong patch priority. NOTE A CONFLICT: the intelligence Tags label this 'Information Disclosure,' whereas the NVD description and CVSS (I:H/A:H) describe code execution and full integrity/availability impact - the description and CVSS should be treated as authoritative, and the 'Information Disclosure' tag verified against the Microsoft advisory.

A standard, non-administrative user (or malware running in a low-privileged context after initial access, e.g., via phishing or a compromised service account) executes a program that submits crafted input to the vulnerable DirectX component, causing it to dereference an attacker-controlled pointer. The resulting memory corruption is leveraged to execute code in a higher-privileged/kernel context, and the Changed scope means the attacker escapes their original sandbox to control the broader system. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS local, low-privilege, no-UI profile.