CVE-2026-44808: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

Use-after-free vulnerability in the Windows DWM Core Library (Desktop Window Manager) allows a local attacker to elevate privileges on affected Windows 11 systems. The attacker must already have a low-privilege local account and shell access; no network exposure is required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the system. A patched-image rebuild at version 10.0.28000.2269 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to begin exploitation.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layouts, or environmental setup beyond having a local account.

Blast Radius

• Reads sensitive data stored on the system, including credentials, tokens, and user files.
• Modifies or deletes persisted files, registry entries, and system configuration.
• Crashes or disrupts affected system services and processes.
• Gains full administrative control over the compromised host, enabling lateral movement or persistence.