EUVD-2026-73062
GHSA-wcmj-3p6q-v9h7
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
AV:N and PR:L per Microsoft's stated 'over a network / authorized attacker' framing; AC:H for UAF memory-state complexity; UI:R for active session requirement; S:U as privilege escalation is contained to the vulnerable host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged authenticated account (PR:L) on or with network access to the target system; the CVSS AV:N vector strongly implies a remote session surface such as RDP, where DWM handles graphical rendering for remote clients. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) places this in the high severity band but with meaningful friction: AC:H signals complex exploitation prerequisites, PR:L requires a pre-existing low-privileged account, and UI:R demands some form of user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch via Windows Update or WSUS: Windows Server 2025 should be updated to build 10.0.26100.33438 or later, and Windows 11 Version 23H2 should be updated to build 10.0.22631.7582 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows Server 2025 and Windows 11 23H2 systems in your environment using asset management tools or Active Directory queries, and assess which systems have network-exposed critical services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today