Desktop Window Manager EUVD-2026-44148

Exploitation requires the attacker to already possess local, authenticated code-execution on the target with at least low privileges (CVSS PR:L, AV:L) - that is, the ability to run a process that can call into the Desktop Window Manager's graphics/composition interfaces within an interactive session. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists there are no special timing or configuration prerequisites and default configurations of the listed Windows builds are affected. What LIMITS exploitation is that it is not remotely triggerable - an attacker cannot reach DWM over the network and must first obtain a local foothold or a valid low-privileged login, which is why this is a privilege-escalation rather than initial-access issue. No non-default feature toggle is required; the flaw affects the shipped Windows 10/11 and Windows Server 2016-2025 configurations.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a local, low-complexity attack requiring low privileges and no user interaction, with a scope change and full C/I/A impact - a classic reliable local privilege-escalation profile scoring 8.8. The AV:L (local) metric means this is not remotely reachable on its own: an attacker must already run code on the host, so realistic risk is highest as the second stage of an intrusion (after phishing, a foothold, or a compromised low-privilege service) or in multi-user/RDS environments. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced, so this is not weaponized. That said, DWM EoP bugs are historically attractive and reliable, and the low complexity plus no-UI requirement mean exploitation, if developed, would be straightforward - this warrants prompt patching on the standard Patch Tuesday cadence rather than emergency response. No conflicting signals were detected between the vector and description; both consistently indicate local privilege elevation.

An attacker who has already gained a low-privileged foothold on a Windows host - for example via a phishing payload or a compromised standard user account on a shared terminal server - invokes the vulnerable Desktop Window Manager interface with crafted parameters that overflow a heap buffer. By grooming the heap and controlling the corrupted data, they redirect execution within the elevated DWM context to run code as SYSTEM. No public exploit identified at time of analysis, but the low attack complexity and lack of required user interaction make a reliable exploit feasible if one is developed.