Executive brief
A security vulnerability exists in the Windows Desktop Window Manager (DWM) Core Library, which is responsible for rendering the visual effects on the Windows desktop. An attacker who already has basic access to a computer could exploit this flaw to view sensitive information that should normally be protected. This could lead to the exposure of system memory contents, potentially aiding in further, more complex attacks against the organization's infrastructure.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists within the Windows DWM Core Library (dwmcore.dll). The flaw is triggered when the component fails to properly validate the length of a buffer before performing a read operation. An attacker with local access and low-level privileges can exploit this to read data from beyond the intended memory buffer. This can result in the disclosure of sensitive information from the process memory, which may include cryptographic keys or pointers useful for bypassing memory protections like ASLR. The vulnerability requires local authentication but no user interaction.
Affected products
- Microsoft Windows
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Microsoft published the security update guide.