A heap‑based buffer overflow in the Windows DWM Core Library enables a local authorized user to gain higher privileges on the host. The vulnerability allows the attacker to corrupt heap objects used by DWM, leading to arbitrary code execution with elevated rights. This is a classic example of CWE‑122, a heap overflow that can be triggered by the attacker’s input to the graphics subsystem.

The flaw affects Microsoft Windows 10 releases 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, 2022, and 2025 (including Server Core installations). Earlier Windows 10/11 versions not listed are not impacted according to the CNA data.

With a CVSS score of 7.8, the vulnerability is considered high severity. EPSS data are not available, and the flaw is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been publicly reported. The attack vector is likely local; an attacker must already have access to the system and a privileged account to exploit the DWM component for privilege escalation. Once triggered, the compromised process can obtain full system rights, exposing the host to data disclosure, modification, or further lateral movement.