What is the CVSS score of EUVD-2026-56444?

EUVD-2026-56444 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Which versions of Desktop Window Manager are affected by EUVD-2026-56444?

Windows Desktop Window Manager contains a privilege escalation flaw allowing authenticated local users to gain complete system-level access.. A patch is available.

How to fix or mitigate EUVD-2026-56444?

Within 24 hours, identify and catalog all Windows systems that could be accessed by low-privileged local users, prioritizing those handling sensitive data or running critical business functions. Within 7 days, implement strict access controls by restricting local user account privileges, disabling unnecessary interactive logins where feasible, and deploying endpoint detection and response tools to monitor Desktop Window Manager process activity for exploitation attempts. Within 30 days, establish ongoing monitoring of Microsoft security advisories for patch availability and develop a deployment and testing plan to apply updates immediately upon release.

Desktop Window Manager EUVD-2026-56444

| CVE-2026-65788 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-wr3x-mp37-wg8h

Denial Of Service Use After Free Memory Corruption Microsoft Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local access and low privilege required; high complexity reflects heap-state dependency; no scope change as DWM is not a hypervisor boundary.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:19 vuln.today

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.

Technical ContextAI

Desktop Window Manager (dwm.exe) is the Windows compositing window manager responsible for rendering the graphical desktop environment, present in all modern Windows releases. CWE-416 (Use After Free) describes a condition where a program continues to reference a memory region after it has been freed, enabling an attacker to place controlled data in that memory and influence subsequent execution flow. In a privileged process like DWM, such a flaw can be leveraged to redirect execution into attacker-controlled code running at elevated privilege. The high attack complexity (AC:H) in the CVSS vector indicates that exploitation requires precise timing or specific memory layout conditions - such as a race condition or heap grooming - to reliably trigger the use-after-free.

RemediationAI

The primary remediation is to apply the Microsoft patch addressing CVE-2026-65788, available via Windows Update or the Microsoft Update Catalog; the exact fixed build version was not confirmed in the provided data and should be verified at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65788. Until patching is complete, compensating controls should focus on limiting local access: restrict interactive and remote desktop logon rights to only necessary users, enforce application allowlisting to reduce attacker tooling options post-compromise, and monitor for anomalous DWM process behavior or unexpected privilege escalation events via EDR telemetry. Note that restricting local logon does not eliminate risk if the environment already has compromised accounts; patching remains the definitive fix.