Microsoft Windows: Elevation of privilege in Desktop Window Manager

Summary

A local out-of-bounds read flaw in the Desktop Window Manager (DWM) of Windows 10, Windows 11 and Windows Server allows an authorized local user to elevate privileges. An attacker needs a low-privileged local account or code running as a standard user, and no user interaction is required. Successful exploitation can lead to full control of the affected system.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809, Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9974 and 10.0.26300.9974 (per CVE record)
• Windows 11 Version 26H1: builds before 10.0.28000.3501 (per CVE record)
• Windows Server 2022: builds before 10.0.20348.5870

Whether all listed Windows 11 branches are affected in practice is not fully confirmed by the sources; verify against the MSRC table.

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9688 (KB5131291)
• Windows 10 1809 / Server 2019: 10.0.17763.9487 (KB5131085)
• Windows 10 21H2: 10.0.19044.7846 (KB5131096)
• Windows 10 22H2: 10.0.19045.7846 (KB5131096 ESU)
• Windows 11 23H2: 10.0.22631.7711 (KB5131087)
• Windows 11 24H2: 10.0.26100.9974 (KB5132061)
• Windows Server 2022: 10.0.20348.5870

Fix build numbers for Windows 11 25H2, 26H2, 26H1 and Windows Server 2022 are not confirmed by the retrieved sources; check the MSRC Security Update Guide.

Workaround

Unknown. No workaround was found in the sources; install the November 2026 security update.

Exploitation

• No public confirmation of active exploitation in the sources retrieved.
• No public proof-of-concept code is known; the CVE record rates exploit code maturity as Unproven.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• The CISA KEV catalogue was not checked.

Our recommendation

• Install the November 2026 cumulative update on all Windows hosts via Windows Update, WSUS or the Microsoft Update Catalog.
• Verify the installed build number against the fixed builds listed above.
• Review which users have local logon on shared systems and Remote Desktop or terminal servers, and remove unneeded accounts.
• Prioritise hosts that run untrusted code or have multiple users.
• Identify systems on Windows 10 1607, 1809 or 21H2 and check ESU eligibility or plan an upgrade.
• Monitor for unusual privilege changes on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113758 msrc.microsoft.com
• CVE Record CVE-2026-113758 www.cve.org
• Strix.ai: CVE-2026-113758 www.strix.ai
• Adminsignal: November 2026 Patch Tuesday priorities www.adminsignal.com
• MalwareTips: Windows 11 November 2026 Patch Tuesday KB5132061/KB5131087 malwaretips.com
• BleepingComputer: November 2026 Patch Tuesday www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:12.