CVE-2026-44804: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

Use-after-free in the Windows DWM Core Library allows a local attacker with a low-privilege account to escalate their privileges on the affected host. The vulnerability is reached locally (no network exposure required) and requires only a standard user account to trigger. Successful exploitation gives the attacker full control over the affected system, including reading sensitive data, modifying files, and crashing or controlling running processes. A patched-image rebuild at version 10.0.28000.2269 is available on HarborGuard for environments running an affected version of Windows 11 26H1.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerability; no administrative rights are needed.

• Victim interactionNot required

  The attacker can exploit this without any action from another user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to be arranged.

Blast Radius

• A successful attacker reads confidential files and stored credentials accessible on the host, including data belonging to higher-privileged processes.
• The attacker modifies system files, registry keys, and application data across the host, not just within their original privilege boundary.
• The attacker gains the ability to terminate, inject into, or fully control other running processes on the system.
• The affected service and dependent processes can be crashed or made unavailable by the attacker at will.