Windows DirectComposition EUVD-2026-99439

Exploitation requires the attacker to already possess authenticated, low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - there is no remote or network path, so a prior foothold via phishing, malware, or a logged-in standard user account is a hard prerequisite. The specific attack surface is the Windows Direct Composition component (the DWM/graphics composition engine present by default on all supported Windows builds), so no non-default feature or configuration toggle is needed. Limiting factors that reduce real-world risk: no remote exploitation, no scalable/automatable abuse (SSVC Automatable=no), and the need for an existing interactive or code-execution foothold; however, UI:N means no victim interaction is required once the attacker is on the box. Risk is highest on shared, multi-user, or terminal-server systems where untrusted users hold local sessions.

Multiple signals converge on this being a genuine but non-emergency patching priority rather than a drop-everything crisis. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8 High) describes a local, low-complexity flaw requiring an already-authenticated low-privileged foothold, with total impact to confidentiality, integrity and availability on the affected host - consistent with a classic kernel/graphics use-after-free used for privilege escalation. CISA's SSVC decision framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (it cannot be sprayed at scale because it needs local access), but Technical Impact=total, matching the C:H/I:H/A:H impact. There is no CISA KEV listing and no POC indicator in the provided data, and no EPSS score was supplied, so exploitation probability cannot be quantified from this input. The signals are internally consistent - there is no conflict between the local attack vector and the description, which also states local elevation of privilege. Net assessment: a high-severity, high-impact local EoP that is typically chained after initial access (phishing, malware, or a compromised standard user) rather than a remotely wormable threat; prioritize in the normal Patch Tuesday cycle for all Windows endpoints and servers, elevated for multi-user or terminal-server hosts where untrusted users have local sessions.

An attacker who already has low-privileged code execution on a Windows host - for example via a phished user or commodity malware - runs a crafted program that manipulates Windows Direct Composition objects to trigger a use-after-free (CWE-416), reclaiming the freed memory to corrupt kernel/component state. Exploiting the dangling reference, they elevate to SYSTEM-level privileges and take full control of the machine. No public exploit was identified at time of analysis, and because the attack vector is local (AV:L) with no user interaction, exploitation requires a pre-existing local foothold rather than remote delivery.