Executive brief
A security vulnerability exists in the Windows Desktop Window Manager (DWM) Core Library, which is responsible for rendering the visual effects on the Windows desktop. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to install programs, view or delete sensitive data, or create new user accounts with full rights.
Technical details
A use-after-free vulnerability (CWE-416) exists within the Windows DWM Core Library (dwmcore.dll). The flaw is triggered when the system attempts to access memory that has already been deallocated, leading to memory corruption. An attacker with local access and low-privileged user rights can exploit this condition to execute arbitrary code with elevated system privileges. The attack requires no user interaction and has a low complexity, making it a reliable path for local privilege escalation (LPE) once initial access to a host is established. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory