CVE-2026-44802: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability exists in the Windows DWM (Desktop Window Manager) Core Library, a component present across multiple versions of Windows 10 and Windows 11. Exploitation requires only a low-privilege local account and no interaction from any other user, derived from the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation gives the attacker full elevation of privileges on the affected host, including read, write, and availability control over the system. Patched-image rebuilds at the fix versions listed above are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service needs to be exposed.

• AuthenticationRequired

  A low-privilege local account is sufficient; no administrative rights are required prior to exploitation.

• Victim interactionNot required

  No action from another user is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or unusual environmental prerequisites required.

Blast Radius

• The attacker gains full read access to memory and on-disk data belonging to higher-privileged processes, including credential stores accessible to SYSTEM.
• The attacker gains write access to privileged process memory and system resources, enabling persistent changes to the host configuration or installed software.
• The attacker can disrupt or terminate privileged system services, causing denial of service at the OS level.
• Privilege escalation to SYSTEM or equivalent gives the attacker effective full control over the compromised host and any workloads running on it.