Windows DWM EUVD-2026-44302

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target (CVSS PR:L, AV:L) - this is not remotely exploitable and cannot be triggered across the network or from an unauthenticated position. No user interaction is needed (UI:N), and no special non-default Windows configuration is described; the vulnerable Desktop Window Manager component runs by default on all listed Windows 10/11 and Windows Server 2016-2025 SKUs, including Server Core installations. The primary limiting factor is the local-access prerequisite: an attacker must first land on the host, making this a post-compromise privilege-escalation step rather than an initial-access vector.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) is internally consistent with a local privilege-escalation flaw: local attack vector, low complexity, low privileges required (an authenticated user must already have code execution on the host), no user interaction, unchanged scope, and full confidentiality/integrity/availability impact consistent with a SYSTEM-level compromise. There is no EPSS score, KEV listing, or SSVC decision framework supplied in the input, so exploitation probability cannot be quantified from the data provided; treated on signals alone this is a real but second-stage priority - it is not a remote entry point but a classic local escalation primitive attackers chain after initial access. DWM is a perennially popular EoP target and the affected footprint is essentially all supported Windows, which raises real-world relevance; however, with no public exploit identified and no evidence of active exploitation, it should be patched on the normal-to-expedited Patch Tuesday cadence rather than as an emergency.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload or a compromised standard user account - runs a crafted local program that drives DWM into the type-confusion condition to corrupt memory in the privileged compositor and elevate to SYSTEM. From there they disable security tooling, install persistence, and move laterally. No public exploit code is identified at time of analysis, and the local attack vector with low complexity means exploitation is straightforward once reliable code exists but requires prior local access.