The Desktop Window Manager (DWM) is responsible for compositing the graphical user interface. This vulnerability is a type‑confusion flaw (CWE‑843) where DWM does not properly validate the type of a resource that is passed to it. Because the flaw can be triggered by an authorized attacker, it allows those users or processes to elevate privileges locally, granting them permissions above those of the original account. The likely attack vector is local, requiring the attacker to have access to the target machine to supply the malicious input to DWM.

Microsoft has identified the vulnerability as affecting Windows 10 releases from 1607 to 22H2, the Windows 11 releases from 22H3 through 26H1, and several Windows Server editions, including Server 2016, Server 2019, Server 2022, and Server 2025. The affected builds span both x64 and x86 platforms, as well as ARM64 for certain Windows 10 and 11 releases, and include Server Core installations. Systems that match any of these build numbers or CPE strings are susceptible and should be considered at risk until patched.

The CVSS score of 7.8 indicates high severity. The EPSS score of 2% suggests a low current exploitation probability. However, the vulnerability is listed in the CISA KEV catalog, indicating that it is actively exploited in the wild. An authorized attacker who can interact with the Desktop Window Manager can elevate privileges locally, potentially enabling further actions under higher permission levels.