CVE-2026-42905: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Desktop Window Manager (DWM) Core Library allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The flaw is reached through local code execution and requires only a low-privilege user account, with no network access or victim interaction needed. Successful exploitation gives the attacker full control over the affected host, including read, write, and crash capabilities over system resources. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local user account is sufficient; no administrative rights are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need to involve or trick any other user; exploitation is entirely self-contained.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or specific memory layout requirements to satisfy.

Blast Radius

• A successful attacker reads sensitive data from memory and the file system, including credentials, tokens, and protected configuration files.
• A successful attacker writes to or modifies privileged system resources, files, and registry keys that are normally protected from low-privilege users.
• A successful attacker can crash or destabilize the affected service or system, causing a denial of service for all users on that host.
• Full SYSTEM-level code execution on the compromised host becomes possible, allowing installation of malware, creation of new privileged accounts, or lateral movement to adjacent systems.