CVE-2026-44804: Windows DWM Use-After-Free Privilege Escalation (7.8 HIGH)

Technical summary

CVE-2026-44804 is a use-after-free vulnerability (CWE-416) in the Windows DWM Core Library. The flaw allows a locally authenticated attacker to cause memory corruption by accessing memory that has been freed, leading to local privilege escalation. The attack vector is local (AV:L), requires low attack complexity (AC:L), and demands low privileges (PR:L) with no user interaction (UI:N). The impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H), confined to the local system (S:U).

Business impact

Compromise of Windows 11 systems via this vulnerability could allow insider threats or compromised local accounts to gain administrative or SYSTEM-level privileges. This enables attackers to install persistent malware, steal sensitive data, modify system configurations, disable security controls, or launch further attacks across the network. Organizations relying on Windows 11 26H1 deployments face elevated risk to their security posture and operational integrity.

Affected systems

Microsoft Windows 11 version 26H1 is confirmed affected. Organizations running this build should verify their deployment scope and prioritize patching accordingly.

Exploitability

Exploitation requires local access with valid user credentials—an insider threat scenario or compromised standard user account. The low attack complexity and absence of user interaction requirements make this practical for attackers with initial system foothold. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the high CVSS score (7.8) and privilege escalation nature warrant rapid remediation regardless of active exploitation reports.

Remediation

Apply the security patch issued for Windows 11 26H1 as soon as possible. Verify patch installation via Windows Update or your organizational patch management system. Consider interim mitigations including strict local account access controls, disabling unnecessary local accounts, and enhanced monitoring of privilege escalation attempts.

Patch guidance

Obtain the latest security update for Windows 11 version 26H1 through Windows Update, Windows Server Update Services (WSUS), or the Microsoft Security Update Guide. Test patches in a non-production environment before broad rollout. Verify successful installation by confirming the patched DWM Core Library version matches Microsoft's advisory guidance.

Detection guidance

Monitor for suspicious privilege escalation activities using Windows Event Viewer (Security log, event IDs 4672, 4688) and endpoint detection and response (EDR) tools. Track unexpected elevation of user privileges, unusual memory access patterns in DWM processes, or application crashes involving dwm.exe. Correlate with successful local logon events (event ID 4624, logon type 2 or 10) to identify potential exploitation attempts.

Why prioritize this

This vulnerability scores HIGH (7.8) due to high-impact privilege escalation on a widely deployed OS. Although it requires pre-existing local access, it eliminates a crucial security boundary. Windows 11 26H1 is current infrastructure; rapid patching prevents insider threats and compromised-account scenarios from becoming full system compromise. Absence from KEV does not diminish urgency given the privilege escalation severity.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects the combination of local attack vector, low complexity, low privilege requirement, and complete compromise of system confidentiality, integrity, and availability. The vulnerability is not widespread in active exploits (KEV status: false), but its fundamental nature—memory safety flaw enabling privilege escalation—and presence in current Windows versions warrant high organizational priority.

Frequently asked questions