Windows DWM Core Library: Out-of-bounds read allows local privilege escalation

Summary

An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library allows an authorized local user to elevate privileges. The attacker needs local code execution or a low-privileged account first. The flaw has a CVSS 3.1 score of 7.8 (High) and affects several Windows 10, Windows 11 and Windows Server versions.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612, CNA data)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (builds below 10.0.19044.7807 and 10.0.19045.7807, the 22H2 value is inconsistent in sources)
• Windows 11 Versions 23H2, 24H2, 25H2 and 26H2 (see MSRC for exact builds)
• Windows Server 2016, 2019, 2022 and 2025 including Server Core installations (see MSRC for exact builds)

NVD lists only Windows 10 1607 in its CPE, but the CNA data covers the wider scope above.

Fixed in

Security updates from Microsoft released on October 13, 2026. Fixed builds per CNA data: Windows 10 1607 from 10.0.14393.9612, Windows 10 1809 from 10.0.17763.9376. Some other build numbers conflict between sources and must be verified on the MSRC advisory before use in compliance checks.

Workaround

• No Microsoft-specific workaround is known.
• If patching is not possible, enforce least-privilege policies and restrict local administrative access.

Exploitation

• Microsoft rates exploit code maturity as unproven.
• CISA SSVC lists exploitation as none and automatable as no.
• The CVE is not in the CISA KEV catalog.
• EPSS is 0.00318. No public proof of concept or exploitation reports were found at the time of research.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, prioritising Windows 10 1607 machines, which are likely near end of support.
• Verify the fixed build numbers on the MSRC advisory before rollout.
• Prioritise shared workstations, terminal servers and endpoints where users have local logon, as this flaw is relevant after phishing, malware or account compromise.
• Check for Windows systems with unsupported OS builds and plan upgrades.
• Do not confuse this CVE with CVE-2026-88180 or CVE-2026-88189, which describe similar DWM flaws.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-88179 msrc.microsoft.com
• CNA/CVE data (Vulners CVELIST) vulners.com
• OpenCVE CVE-2026-88179 app.opencve.io
• Vulnrichment (Vulners) CVE-2026-88179 vulners.com
• Strix.ai CVE-2026-88179 (secondary, verify) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:12.