Windows DWM Core EUVD-2026-99559

Exploitation requires the attacker to already possess local, authenticated low-level privileges on the target (PR:L, AV:L) - this is a post-access privilege-escalation, not a remote entry point. No user interaction is needed (UI:N). The high attack complexity (AC:H) is the primary limiting factor: successfully exploiting the use-after-free in DWM Core almost certainly depends on winning a timing/race window and achieving a specific memory layout, so exploitation is unreliable and not guaranteed per attempt. The DWM Core Library is present by default on all affected Windows builds, so no special non-default configuration is required beyond having an interactive/standard user foothold on an unpatched system (builds below the fixed versions listed in EUVD, e.g. Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650).

This is a locally exploitable use-after-free (CWE-416) in the Windows DWM Core Library carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector signals constrain real-world risk: exploitation requires local access (AV:L) and existing low-level privileges (PR:L), and the high attack complexity (AC:H) is consistent with a use-after-free that likely depends on winning a race condition or precise heap state, making reliable exploitation non-trivial. Impact is severe once triggered - full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) with an unchanged scope, typical of a privilege escalation from a standard user to SYSTEM. No EPSS score was provided, and there is no CISA KEV listing or public POC in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This profile fits a classic patch-Tuesday-class local EoP: valuable to attackers as a post-compromise step but not a remote, wormable, or drive-by threat. Prioritize as part of normal Windows patching rather than as an emergency, while noting that DWM EoP bugs have historically been attractive targets once patch-derived exploits emerge.

An attacker who has already achieved low-privileged code execution on a Windows host (for example via phishing or a compromised standard user account) runs a crafted program that manipulates the Desktop Window Manager to trigger the use-after-free in the DWM Core Library. By grooming memory and winning the required race, they reuse the freed object to corrupt kernel/privileged state and elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation is not guaranteed on each attempt.