CVE-2026-44811: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows DWM Core Library (Desktop Window Manager) allows a local attacker to escalate privileges on the affected system. The attacker must already hold a low-privilege local account and does not need to reach the system over a network; no user interaction is required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the host. A patched-image rebuild at version 10.0.28000.2269 is available on HarborGuard for environments running an affected version of Windows 11 26H1.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to attempt exploitation.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can trigger the vulnerability directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• A successful attacker reads protected files, credentials, and in-memory secrets belonging to other processes or users on the host.
• A successful attacker modifies or overwrites files, registry entries, and process memory outside the bounds of their original low-privilege account.
• A successful attacker crashes or destabilizes the Desktop Window Manager and dependent system services, disrupting the host session.
• Combined high-impact ratings across confidentiality, integrity, and availability mean the attacker effectively achieves full local system compromise.