Windows Direct Composition EUVD-2026-99405

Exploitation requires the attacker to already have local, authenticated access with the ability to execute arbitrary code at a standard (low-privilege) level on the target Windows system (PR:L, AV:L); it cannot be triggered remotely or over a network. The attacker must invoke the Windows Direct Composition component (the DWM/composition graphics subsystem present by default on supported Windows client and server builds) with input crafted to trigger the heap-based buffer overflow. No user interaction is required (UI:N) and no special non-default configuration is named in the advisory - the affected component ships enabled by default across the listed Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The primary limiting factor is the mandatory local foothold: this flaw only helps an attacker who has already breached the host, serving as a privilege-escalation step rather than an entry point.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H) describes a local, low-complexity elevation-of-privilege flaw requiring an authenticated foothold (PR:L) and no user interaction, yielding total compromise of the host once triggered - consistent with the base score of 7.8 and CWE-122 heap overflow. The signals are internally consistent and do NOT indicate an urgent remote threat: CISA's SSVC framework reports Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path, while Technical Impact=total aligns with the C:H/I:H/A:H impacts. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so there is no public exploit identified at time of analysis. The defining limiter is the local attack vector: an attacker must already be able to run code on the machine (standard user), making this a post-compromise privilege-escalation building block rather than an initial-access or wormable issue. Given Windows' enormous install base, it should be patched on the normal Patch Tuesday cadence and prioritized on multi-user or sandbox-escape-sensitive hosts, but it is not a drop-everything emergency absent evidence of exploitation.

An attacker who already has unprivileged code execution on a Windows host (for example via phishing, a malicious installer, or a compromised low-privilege service) runs a crafted program that drives the Direct Composition component to trigger the heap-based buffer overflow. By corrupting heap structures they overwrite memory to execute code in a higher-privileged context, escalating from standard user to SYSTEM. No public proof-of-concept is referenced and CISA SSVC reports no observed exploitation, but low attack complexity makes reliable exploitation plausible once technique details are reverse-engineered from the patch.