CVE-2026-44807: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

Use-after-free in Windows DWM Core Library (the compositor responsible for rendering the Windows desktop) allows a local attacker with a standard user account to escalate privileges on affected Windows 11 26H1 systems. The vulnerability is reachable locally and requires no network exposure; any low-privilege process or shell on the host is sufficient to trigger it. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 10.0.28000.2269 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the use-after-free entirely from their own process without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads protected process memory, credentials, and other sensitive data belonging to higher-privileged processes.
• Writes to or modifies system state, files, and registry entries that a standard user account would normally be blocked from changing.
• Crashes or disrupts system services and processes, including the DWM compositor itself, causing desktop instability or denial of service.
• Provides a foothold for full system compromise by chaining this privilege escalation with other exploits or lateral-movement techniques.