CVE-2026-42983: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows DWM (Desktop Window Manager) Core Library allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The flaw is reachable without any network exposure and requires only a low-privilege local account, meaning an attacker who has already gained a foothold on the system can exploit it without elevated rights. Successful exploitation grants full control over the affected system, including read, write, and execution capabilities at a higher privilege level. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service needs to be exposed.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or system-level credentials to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the use-after-free condition entirely from their own session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker elevates their process privileges to SYSTEM or equivalent, gaining full administrative control of the host.
• Reads any file, credential, or secret accessible to higher-privileged processes, including tokens stored by other running services.
• Modifies or overwrites system files, registry keys, and persisted application data on the host.
• Crashes or terminates arbitrary processes, including security tooling and monitoring agents running on the same machine.