An integer overflow or wraparound in the Windows DWM Core Library allows an authorized local attacker to gain elevated privileges. This flaw, classified as a buffer overflow (CWE-122) weakness, can be leveraged by a user with permission to run code that interacts with the DWM library, giving them higher privileges on the system. The impact is a local privilege escalation that can enable the attacker to access resources, modify configurations, or execute actions otherwise restricted to higher‑privileged users.

Microsoft Windows 10 1607, 1809, 21 H2, 22 H2; Windows 11 23 H2, 24 H2, 25 H2, 26 H1; Windows Server 2016, 2019, 2022, 2025, and the 2022 23 H2 edition are affected. The vulnerability applies to both Intel and AMD 32‑bit, 64‑bit, and ARM64 builds as listed in the CPEs.

The CVSS score of 7.8 indicates a high severity vulnerability, and the EPSS score is less than 1 %, suggesting a low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The attack vector is local; an attacker must already have permission to run applications that load the DWM library and then trigger the integer overflow or wraparound condition. No remote or unauthenticated exploitation is indicated by the current data.