CVE-2026-45637: Microsoft DWM Core Library Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Desktop Window Manager (DWM) Core Library allows a local attacker with a standard user account to elevate their privileges on the affected machine. The flaw is reached locally, requires no network exposure, and exploitation does not depend on any action by another user. Successful exploitation gives the attacker full control over the host, combining high confidentiality, integrity, and availability impact. Patched-image rebuilds at the relevant fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No action from another user is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker reads protected system files, credentials, and secrets stored on the host.
• A successful attacker modifies system configuration, persisted files, and other users' data on the machine.
• A successful attacker can crash or disable the operating system or any service running on it.
• Combined high impact across all three dimensions means a standard user account effectively becomes a full system compromise.