Microsoft Windows EUVD-2026-44312

Exploitation requires the attacker to already have a low-privileged authenticated local session on the target (CVSS PR:L, AV:L) running Windows 11 version 26H1 - it cannot be triggered remotely or by an unauthenticated user. The specific prerequisite is the ability to execute code that interacts with the Desktop Window Manager to reach the vulnerable use-after-free path; no special non-default configuration is named in the advisory. Limiting factors: the attacker needs prior code-execution/foothold on the host and the machine must be the specific 26H1 build, but no user interaction is needed and attack complexity is low, so once a foothold exists the barrier to elevation is minimal.

The signals are moderately concerning but not emergency-level. The CVSS base score of 7.8 (High) reflects local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction, and high impact across C/I/A - a classic privilege-escalation profile rather than a remotely reachable flaw. Because AV:L requires the attacker to already have code execution or an authenticated foothold on the host, this is typically a second-stage tool rather than an initial-access vector. There is no EPSS score, no SSVC decision data, and no KEV listing provided, so exploitation probability cannot be quantified; the absence of public POC lowers immediate urgency. No signals conflict - the description (local elevation) and the CVSS vector (AV:L, PR:L) are consistent. Overall this is a real but standard patch-in-normal-cycle priority for Windows 11 26H1 fleets, warranting prompt patching on multi-user or high-value hosts where local footholds are plausible.

An attacker who has already gained a low-privileged authenticated session on a Windows 11 26H1 machine - for example via phishing-delivered malware or stolen standard-user credentials - runs a crafted program that manipulates DWM graphics objects to trigger the use-after-free, grooms the heap to reoccupy the freed memory, and hijacks the dangling pointer to execute code in the privileged DWM context, achieving SYSTEM-level control. No user interaction is required and attack complexity is low, so exploitation would be reliable once working code is developed, though no public exploit currently exists.