Windows Direct Composition EUVD-2026-99430

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (CVSS PR:L) - this is a privilege-escalation primitive, not a remote entry point. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the attacker must be able to reach and invoke the Windows Direct Composition (DirectComposition/dcomp) code path to trigger the use-after-free. The limiting factor is the prerequisite local foothold; the flaw cannot be exploited remotely or by an unauthenticated attacker, so realistic risk is confined to post-compromise or malicious-insider/local-malware scenarios. Patched builds are available per the EUVD affected-version ranges (e.g., Windows 11 24H2 fixed in 10.0.26100.9711, Server 2025 in 10.0.26100.33650).

This is a locally-exploitable, authenticated elevation-of-privilege flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) - a use-after-free (CWE-416) in the Windows Direct Composition component. The CVSS vector confirms an attacker must already have local access and low-level privileges (PR:L), but needs no user interaction and faces low attack complexity, yielding total compromise of confidentiality, integrity, and availability on the host. Multiple signals point AWAY from immediate mass-exploitation risk: the CVE is NOT in CISA KEV, no public POC or exploit code is identified in the supplied data, and the CISA SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' - meaning no observed exploitation and no reliable mass-automation path. This aligns with the low-privilege-local nature: an attacker needs a foothold first, so it is a post-compromise escalation primitive rather than an initial-access vector. However, SSVC rates Technical Impact as 'total,' consistent with the C:H/I:H/A:H kernel/graphics-stack compromise, so once chained after initial access it is high-consequence. No EPSS score was provided, so exploitation probability cannot be independently quantified. Net: a genuine patch-priority item for Windows fleets due to ubiquity and total impact, but not an emergency - there is no evidence of active exploitation or automatable mass abuse at time of analysis.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a sandboxed process) invokes the vulnerable Direct Composition code path to trigger the use-after-free, corrupting kernel/graphics-subsystem memory to run code at a higher privilege level. No public exploit code is identified at time of analysis, and exploitation requires local access with existing low privileges and no user interaction.