Desktop Window Manager EUVD-2026-99103

Exploitation requires the attacker to already have local, low-privileged execution on the target Windows system (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. The flaw lies in Desktop Window Manager (dwm.exe), a graphics-stack component present and running by default on all Windows desktop installations, so no special feature or non-default configuration is needed to reach the vulnerable code; the type-confusion condition is triggered by a locally executed crafted program. The principal limiting factor is the local-access prerequisite: a remote attacker cannot exploit this directly and must first obtain a foothold. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once local access exists exploitation is straightforward.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent and credible for a Desktop Window Manager (dwm.exe) type-confusion flaw: it requires local access and low privileges (an authenticated standard user or a process the attacker already controls), but then yields high confidentiality, integrity, and availability impact - classic local privilege escalation to SYSTEM. No EPSS score was provided in the input, and KEV status is not present, so there is no signal of active exploitation - per the precision rules this is 'no public exploit identified at time of analysis.' No POC was supplied either. The description ('local') and the CVSS attack vector (AV:L) agree, so there is no vector/description conflict. The one notable discrepancy is between the input Tags ('Information Disclosure', 'Memory Corruption') and the actual vulnerability class: this is a type-confusion (CWE-843) elevation-of-privilege issue with full C/I/A impact, not merely information disclosure. The risk profile is typical of Patch-Tuesday EOP bugs: not remotely wormable, but highly valuable as the second stage of an exploit chain after initial access, and therefore a reliable candidate for eventual real-world weaponization once patched details or a POC emerge. Priority: patch promptly, but it is not a drop-everything emergency absent exploitation evidence.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious document, or a compromised standard user account - runs a crafted program that triggers the type-confusion condition in Desktop Window Manager to corrupt memory and elevate to SYSTEM. No user interaction is required and attack complexity is low. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE rather than a confirmed POC.