EUVD-2026-56349
GHSA-m24g-q7xm-f893
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only read primitive requiring a standard user session; no integrity or availability impact from an out-of-bounds read alone.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds memory read in Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. Exploitation requires an authenticated local session with at least low-privilege access (PR:L per CVSS), making this an insider-threat or post-compromise escalation primitive rather than an initial-access vector. No public exploit code has been identified and CISA KEV does not list this vulnerability; Microsoft has released patches via the July 2026 Patch Tuesday cycle.
Technical ContextAI
The Desktop Window Manager (DWM) is the compositing window manager introduced in Windows Vista, responsible for rendering the visual desktop shell including transparency, animations, and live thumbnails. It runs as a privileged system service (dwm.exe) under the DWM session. CWE-125 (Out-of-bounds Read) indicates the DWM Core Library reads beyond the bounds of an allocated buffer - likely in parsing or processing graphical data structures - exposing adjacent heap or stack memory to the caller. Despite the tag 'Buffer Overflow' in the intelligence feed, this is a read-side flaw with no write primitive, confining impact to information disclosure (C:H/I:N/A:N). Affected CPEs span Windows 10 (build 17763-19045), Windows 11 (22631-28000), Windows Server 2019, 2022, and 2025 per EUVD-2026-56349.
RemediationAI
Vendor-released patch: Apply the July 2026 Microsoft Patch Tuesday cumulative updates targeting the specific build thresholds listed per OS version (e.g., Windows 11 24H2 to 10.0.26100.9168 or later; Windows Server 2019 to 10.0.17763.9115 or later). Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62703 for the exact KB article corresponding to each Windows release. As a compensating control where patching is delayed, restricting interactive and remote desktop logon rights to only necessary accounts reduces the local attacker surface, though this does not eliminate risk for legitimate low-privilege users. Server Core installations are equally affected and require the same cumulative update path.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today