Use after free in the Windows Desktop Window Manager (DWM) Core Library can be triggered by an authorized local attacker. The flaw allows the attacker to corrupt memory in a way that results in the escalation of her or his privileges to those of the system process, effectively granting elevated local rights. The vulnerability is a classic memory corruption weakness (CWE‑416) and is limited to the local scope, but it bridges the gap between ordinary user privileges and system level control.

Microsoft Windows 10 build 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, and 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). All listed versions are affected by the use‑after‑free flaw in the DWM Core Library.

The CVSS score of 7.8 rates this flaw as high severity. No EPSS score is publicly available, but the lack of a KEV listing does not diminish the relevance for local attackers who can run malicious code. The exploitation requires local access; an attacker must be able to launch code on the target machine, but no elevated privileges are required to begin the attack. Once exploited, the attacker can acquire system level rights and compromise the integrity of the affected host.