Windows DWM EUVD-2026-99557

Exploitation requires the attacker to already have local, authenticated access to the target as at least a low-privilege user (PR:L, AV:L) - there is no remote or network-reachable path. The attacker must execute code locally that interacts with the Desktop Window Manager (DWM) Core Library to trigger the out-of-bounds read; DWM is present and running by default on all affected Windows client and Server (including Server Core) installations, so no special feature toggle is needed. The principal LIMITING factors are: (1) the mandatory pre-existing local foothold, and (2) high attack complexity (AC:H), which implies the attacker must win a race or achieve precise memory/heap conditions for a reliable leak - making opportunistic, automatable exploitation unlikely (SSVC Automatable = no). No user interaction is required (UI:N).

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local, high-complexity attack requiring an already-authenticated low-privilege user, which caps the base score at 7.0 (High) despite full C:H/I:H/A:H impact. Multiple real-world signals point AWAY from urgency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', consistent with the absence of any KEV listing or public POC. The one signal pushing severity up is SSVC Technical Impact = 'total', aligning with the full-impact CVSS triad and the typical outcome of a DWM Core kernel bug (SYSTEM-level elevation). Note a classification tension: CWE-125 (out-of-bounds READ) and the 'Information Disclosure' tag imply a memory-disclosure primitive, yet the vector asserts I:H and A:H - a read-only primitive usually yields confidentiality impact alone. This likely reflects Microsoft rating it as an elevation-of-privilege chain where the leak defeats kernel mitigations (KASLR) to enable escalation; treat the I:H/A:H as the downstream EoP outcome rather than a direct effect of the read, and verify against MSRC. Net: a legitimate patch-on-cycle item for Windows fleets, not a drop-everything issue, given local access + high complexity + no observed exploitation.

An attacker who already has a foothold as a standard (low-privilege) user on a Windows host - via phishing, a prior RCE, or a malicious local account - runs code that drives the DWM Core Library into an out-of-bounds read condition. The leaked kernel memory is used to defeat address-space mitigations and pivot the bug into a full privilege escalation to SYSTEM. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) suggests reliable exploitation requires precise heap or timing control.