Desktop Window Manager EUVD-2026-99200

Requires an attacker to already have authenticated local code execution at low privilege (PR:L) on the target host - there is no remote or network path, and the vulnerable component is Desktop Window Manager, a default-present, always-running Windows compositor service, so no special configuration or non-default feature needs to be enabled. No user interaction is required (UI:N). The primary limiting factors are the need for an existing local low-privileged foothold and that the impact is confined to information disclosure (C:H, I:N, A:N) - it does not by itself grant code execution, privilege escalation, or denial of service. All supported Windows client and server editions below the fixed build numbers listed in EUVD-2026-99200 are affected.

This is a medium-severity, low-priority issue despite affecting a ubiquitous product. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information disclosure requiring the attacker to already have a foothold with low privileges on the target system - not a remote threat. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial, which together argue against prioritizing emergency patching. The vulnerability is NOT in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. EPSS exploitation probability was NOT provided in the input and therefore cannot be factored in - this is a data gap. The signals are internally consistent (local vector + no exploitation + partial impact all point to low real-world risk); the only notable tension is that the vector rates confidentiality as High (C:H) while the SSVC technical impact is only 'partial', suggesting the memory disclosure is meaningful but not total system compromise. Net: treat as routine patch-cycle remediation, not an out-of-band emergency.

An attacker who already has the ability to run code as a low-privileged local user (e.g., a standard logged-in account or a sandboxed process) invokes Desktop Window Manager in a way that triggers a buffer over-read, causing DWM to return adjacent process memory. The leaked bytes could contain sensitive data such as pointers, tokens, or other secrets useful for defeating ASLR or escalating a broader attack. No public proof-of-concept was identified in the available data, and no user interaction is required.