An out‑of‑bounds read flaw was discovered in the Windows Desktop Window Manager (DWM) core library. Classified as CWE‑125, this weakness allows an attacker with local authorized access to read memory beyond a buffer’s boundary. The read operation can lead to corruption of program state, enabling the attacker to elevate privileges to those of the system (administrative rights) and perform unauthorized actions on the host.

Microsoft Windows products affected include Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H2 (both x64 and arm64); and Windows Server 2019 (including Server Core), 2022, and 2025 (including Server Core). All listed builds contain the vulnerable DWM core library and are at risk if no update has been applied.

The vulnerability carries a CVSS score of 7.8, indicating a high severity event. While no EPSS score is currently available and the flaw is not listed in the CISA KEV catalog, the local–privileged attack vector means that any user with the ability to run code on the system can potentially exploit it. As such, the risk is significant for environments that cannot enforce strong privilege separation or limit local user rights.