CVE-2026-44813: Windows DWM Core Library Elevation of Privilege Vulnerability

Synopsis

Use-after-free in the Windows DWM Core Library allows a locally authenticated attacker to elevate privileges to SYSTEM or equivalent. The vulnerability is reached from a local session with a low-privilege account and requires no network exposure or victim interaction. Successful exploitation gives the attacker full read, write, and availability control over the affected host. A patched-image rebuild at version 10.0.28000.2269 is available on HarborGuard for environments running an affected image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to begin the attack.

• Victim interactionNot required

  The attacker can execute the exploit entirely on their own without requiring any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites are needed.

Blast Radius

• Reads protected process memory, credential material, and sensitive user data stored on the host.
• Modifies system files, registry keys, or security configuration by writing with elevated privileges.
• Can terminate, suspend, or degrade services running on the affected host, disrupting availability.
• Full privilege escalation to SYSTEM-level access enables lateral movement or persistence within the host environment.