Microsoft Windows DWM Core Library: Local privilege escalation

Summary

A flaw in the Windows DWM Core Library, the component that composites windows and desktop effects, allows an authorized local user to elevate privileges. An attacker needs an existing low-privileged account or foothold on the system, and exploitation is rated high complexity. The CNA rates the impact as high for confidentiality, integrity and availability. The NVD description is a placeholder and the CWE is contested, so the exact weakness is not yet confirmed.

Affected

• Windows 10 Version 1809 (before 10.0.17763.9487)
• Windows 10 Version 21H2 (before 10.0.19044.7846)
• Windows 10 Version 22H2 (before 10.0.19045.7846)
• Windows 11 Version 23H2 (before 10.0.22631.7711)
• Windows 11 Version 24H2 (before 10.0.26100.9974)
• Windows 11 Version 25H2 (before 10.0.26200.9974)
• Windows 11 Version 26H2 (before 10.0.26300.9974)
• Windows Server 2019, including Server Core (before 10.0.17763.9487)
• Windows Server 2022 (before 10.0.20348.5870)
• Windows Server 2025, including Server Core (before 10.0.26100.33822)

Fixed in

Install the November 2026 security update for the affected editions. The fixed builds are listed in the affected section, as stated in the CNA record. The KB numbers are not confirmed in the sources available.

Workaround

Unknown. No vendor workaround was found. The practical mitigation is to install the patch.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept or exploitation report was found for this CVE.
• Microsoft's November 2026 release reports one exploited vulnerability, but the sources do not name this CVE.
• The CVE was published on the same day, so the status may change.

Our recommendation

• Check the MSRC advisory and confirm the KB number and fixed build for each affected edition.
• Install the November 2026 update, prioritising multi-user servers, Remote Desktop and VDI hosts, and shared workstations.
• Identify older builds (Windows 10 1809, 21H2, 22H2) and verify their support status separately.
• Review the NVD entry after analysis completes, as the description and CWE may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org CNA record CVE-2026-112986 www.cve.org
• Microsoft Security Response Center advisory CVE-2026-112986 msrc.microsoft.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Cisco Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:06.