The Desktop Window Manager (DWM) is responsible for compositing the graphical user interface. In affected versions, DWM fails to validate the type of a resource passed to it, leading to a type‑confusion condition. This vulnerability allows an authorized attacker to elevate privileges locally due to the type‑confusion in DWM, potentially enabling arbitrary code execution with higher permissions.

Microsoft has identified the vulnerability as affecting Windows 10 releases from 1607 to 22H2, the Windows 11 releases from 22H3 through 26H1, and several Windows Server editions, including Server 2016, Server 2019, Server 2022, and Server 2025. The affected builds span both x64 and x86 platforms, as well as ARM64 for certain Windows 10 and 11 releases, and include Server Core installations. Systems that match any of these build numbers or CPE strings are susceptible and should be considered at risk until patched.

The CVSS score of 7.8 indicates high severity. The EPSS of 5% suggests a moderate exploitation probability. The KEV listing confirms that this flaw is actively exploited. An authorized attacker can elevate privileges locally, potentially enabling arbitrary code execution with higher permissions.