Microsoft Windows Desktop Window Manager: Local privilege escalation

Summary

A local elevation of privilege vulnerability in the Windows Desktop Window Manager (DWM), a core Windows component that composes the desktop and windows, allows an attacker to gain higher privileges on the affected system. The attacker needs an existing local account with low privileges, but no user interaction is required. The CVE record lists the weakness as CWE-763 (Release of Invalid Pointer or Reference), and the CVSS vector rates the impact on confidentiality, integrity and availability as high (7.8).

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Fixed builds as listed in the CVE record: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974, 10.0.20348.5870, 10.0.26100.33822
• Fixes are delivered with the November 2026 Windows security updates. KB numbers: Unknown.

Workaround

Unknown. No workaround was identified; applying the security update is the fix.

Exploitation

• No evidence of exploitation in the wild was found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public proof of concept was found. The CVSS exploit maturity is unproven (E:U).
• Not yet checked against the CISA KEV catalog.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, 11 and Server systems, prioritising multi-user hosts such as terminal servers, RDS/Citrix hosts and shared workstations.
• Confirm the build number on each host after installation against the fixed builds listed above.
• Check the support status of Windows 10 1809 and 21H2, which are older branches.
• Limit local logon rights to necessary users and monitor for unusual privilege escalation on critical hosts.
• Verify the details in the MSRC advisory and the CISA KEV catalog.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-96172 www.cve.org
• Microsoft Security Update Guide CVE-2026-96172 msrc.microsoft.com
• Strix CVE-2026-96172 tracker www.strix.ai
• OffSeq threat tracker CVE-2026-96172 radar.offseq.com
• Rapid7 Patch Tuesday January 2026 (context) www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:27.