A heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library enables an attacker who already has local user privileges to gain higher system authority. The flaw, defined as CWE-122, allows overwritten memory regions during rendering operations to trigger arbitrary code execution within the DWM process, resulting in privilege escalation on the affected host.

The vulnerability applies to Microsoft Windows 10 versions 1507 through 22H2, Windows 11 releases 22H2 through 25H2, and all Windows Server editions from 2016 to 2025, including both standard and server core installations. Local users on these systems can exploit the flaw without network or remote access.

The CVSS score of 7.8 denotes a high severity, yet the EPSS score of less than 1% indicates that widespread exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authorized code; the attack surface is limited to machines where an attacker can run code or install malware.