An out‑of‑bounds read vulnerability in Windows DWM Core Library can allow an authorized attacker with local access to read memory beyond the bounds of an object. This flaw may enable the attacker to elevate privileges on the machine, potentially reaching SYSTEM or administrative rights. The weakness corresponds to CWE‑125, an out‑of‑bounds read condition.

Microsoft Windows 10 versions 1809, 21 H2, 22 H2; Microsoft Windows 11 versions 23 H2, 24 H2, 25 H2, 26 H2; Microsoft Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

This vulnerability carries a CVSS score of 7.8, indicating a high severity of local privilege escalation. The EPSS score is not available, so the likelihood of exploitation is uncertain, but the lack of a KEV listing suggests no large‑scale exploit has been observed as of now. Attackers would need authorized local presence to exploit the issue, and an attacker with such access could leverage the out‑of‑bounds read to gain higher privileges on the compromised system.