Desktop Window Manager: Local privilege escalation via invalid pointer

Summary

Microsoft's Desktop Window Manager (DWM), a Windows component that composes desktop windows and graphics, contains a flaw classified as CWE-763 (release of invalid pointer or reference). An authorized local attacker with a low-privileged account can exploit it to gain higher privileges, with potential full impact on confidentiality, integrity and availability. Exploitation requires local access and no user interaction. The NVD rating is CVSS 7.8 (High), and NVD analysis was still pending at publication.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to < 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5870)
• Windows Server 2025 incl. Server Core (10.0.26100.0 to < 10.0.26100.33822)
• Note: the CNA record lists these ranges; the full list has not yet been confirmed on the MSRC page.

Fixed in

• Fixed in the Microsoft security updates released with the cumulative updates for the affected builds (expected: November 2026 Patch Tuesday).
• Patched builds per third-party sources: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846.
• Other fixed builds: Unknown. Verify on the MSRC advisory.

Workaround

Unknown. No vendor workaround has been identified; patching is the only documented remediation.

Exploitation

• OffSeq lists the vulnerability as not known to be exploited.
• CISA SSVC assessment: Exploitation none, not automatable, total technical impact.
• No CISA KEV entry, public proof of concept or vendor 'Exploitation Detected' flag was found as of 11 Nov 2026. Whether MSRC marks it as exploited is unknown.
• Other DWM local privilege-escalation bugs were exploited as zero-days earlier in 2026.

Our recommendation

• Install the November 2026 cumulative updates (or the later build listed in MSRC) on all affected Windows 10, 11 and Server systems.
• Prioritise shared workstations, terminal servers and systems with untrusted local users.
• Check whether Windows 10 21H2 and 22H2 systems still receive updates or are enrolled in ESU.
• Verify the affected and fixed build list against the MSRC advisory before rollout.
• Reduce the risk of local escalation: enforce MFA, least privilege, and endpoint protection.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-96175 msrc.microsoft.com
• OffSeq Radar: CVE-2026-96175 radar.offseq.com
• Strix: CVE-2026-96175 www.strix.ai
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• CyberPress: Desktop Window Manager zero-day vulnerability cyberpress.org
• Rapid7: Patch Tuesday January 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:28.