CVE-2026-32155

What it actually does

This vulnerability is a local privilege escalation flaw caused by a use-after-free condition in Windows Desktop Window Manager. An attacker who already has the ability to run code as a low-privileged local user can trigger incorrect memory reuse in the DWM component and potentially execute code with higher privileges, likely in a highly privileged Windows context. Successful exploitation can provide full confidentiality, integrity, and availability impact on the affected host, but it is not remotely exploitable by itself and requires prior local code execution.

Why it matters to the business

If exploited, this flaw can allow an attacker who has gained an initial foothold on a Windows workstation or server to become an administrator or SYSTEM-level user, enabling credential theft, security tool tampering, lateral movement, persistence, and full host takeover. It affects supported Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 releases, so exposure may be broad in organizations with standard Windows fleets. The CVSS score is high at 7.8, but current public exploitation signals are low: EPSS is approximately 0.26%, unchanged over 30 days, it is not listed in CISA KEV, and no exploit maturity is currently reported.

How an attack unfolds

An attacker first needs access to a vulnerable Windows system with the ability to execute local code, such as through stolen credentials, malware execution, phishing, an exposed remote access service, or post-compromise access from another vulnerability. The attacker then runs a crafted local program that interacts with Desktop Window Manager in a way that causes a use-after-free memory condition. By carefully shaping memory contents after the freed object is reused, the attacker attempts to redirect execution or corrupt privileged state. If successful, the attacker elevates from a low-privileged user context to a higher-privileged context and can then run commands, dump credentials, disable defenses, install persistence, or move laterally. Because no public exploit maturity is currently reported, defenders should prioritize patching as part of regular Windows security update cycles while monitoring for local privilege escalation behavior following suspicious user-level execution.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, and 25H2, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Security Update Guide to identify and deploy the applicable cumulative update for each operating system release. Prioritize systems where untrusted users can log on interactively, shared workstations, VDI hosts, RDS/session hosts, developer workstations, jump boxes, and servers that process user-supplied files or have frequent administrative access. Where immediate patching is not possible, reduce risk by limiting local logon rights, enforcing least privilege, restricting execution of untrusted binaries, enabling attack surface reduction rules, monitoring child process creation from user-writable locations, and ensuring EDR tamper protection is enabled.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Validate through centralized patch inventory, Windows Update history, Microsoft Defender Vulnerability Management, Configuration Manager, Intune, WSUS compliance reports, or authenticated vulnerability scanning. On representative hosts, verify the OS build and installed hotfix list using supported administrative tooling such as winver, systeminfo, Get-HotFix, or the Windows Update API, then compare against Microsoft’s Security Update Guide for the April 2026 update set or later superseding cumulative updates. Confirm that unpatched Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems no longer appear in vulnerability scan results. Also validate that least-privilege controls remain effective by checking that standard users cannot create services, modify privileged startup locations, disable security tools, or obtain administrative tokens without authorization.

Typical attack path

1. Gain initial local code execution on a vulnerable Windows workstation or server using phishing, malware, stolen credentials, remote access abuse, or another vulnerability.
2. Execute a malicious local binary or script under a low-privileged user account.
3. Trigger the Desktop Window Manager use-after-free condition through crafted local interactions with the graphical subsystem.
4. Manipulate freed memory to obtain elevated execution or privileged token access.
5. Run post-exploitation actions such as credential dumping, disabling security controls, creating privileged accounts, installing persistence, or moving laterally.

How to detect it

Detection should focus on signs of attempted or successful local privilege escalation rather than a single network indicator, because this is a local Windows memory corruption flaw and no public exploit-specific indicators are currently established. Review endpoint telemetry, EDR alerts, Windows Security logs, Sysmon logs, crash telemetry, Windows Error Reporting, and application event logs for unusual dwm.exe crashes or instability followed by elevated process creation. Look for low-privileged user processes launching command shells, PowerShell, rundll32, regsvr32, mshta, wscript, cscript, schtasks, sc.exe, net.exe, or other administrative utilities shortly before new service creation, local administrator group modification, credential dumping attempts, or security tool tampering. Relevant Windows events include process creation, token elevation, service installation, scheduled task creation, local group membership changes, logon type anomalies, and Defender/EDR tamper events. Useful sources include Windows Security Event IDs 4688, 4672, 7045 via System logs, 4697, 4698, 4720, 4728, 4732, 4738, Sysmon Event IDs 1, 7, 10, 11, 12, 13, 22, Windows Error Reporting events, Application Error events, and EDR process lineage. Investigate cases where dwm.exe crashes are temporally correlated with suspicious binaries executed from user-writable paths or with immediate privilege changes. Since no KEV listing, ransomware association, named threat actor activity, or public exploit maturity is reported, use behavioral hunting and patch validation rather than relying on known exploit hashes or network signatures.

• dwm.exe
• Faulting application name: dwm.exe
• Desktop Window Manager
• Windows Error Reporting
• Application Error
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Sysmon Event ID 1
• Sysmon Event ID 10
• sc.exe create
• schtasks.exe /create
• net localgroup administrators
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami /priv
• whoami.exe /groups
• procdump.exe -ma lsass.exe
• rundll32.exe
• regsvr32.exe
• mshta.exe
• wscript.exe
• cscript.exe

What your security team should do

• Patch affected Windows endpoints and servers through the normal high-priority operating system update process, prioritizing interactive-user systems and administrative access points first.
• Use asset inventory to identify all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems and verify they are receiving current cumulative updates.
• Harden local privilege boundaries by removing unnecessary local administrator rights, limiting RDP/local logon access, and enforcing privileged access management for administrator sessions.
• Increase monitoring for suspicious privilege escalation behavior, especially low-privileged processes spawning administrative shells, service creation, credential dumping tools, or security control tampering.
• Correlate any Desktop Window Manager crashes or unusual dwm.exe behavior with preceding user-level process execution from temporary, downloads, profile, or other user-writable directories.
• Ensure EDR, Microsoft Defender, tamper protection, LSASS protection, and attack surface reduction policies are enabled and enforced on high-risk endpoints.
• Because this is not currently in CISA KEV and EPSS remains low, treat it as important patching rather than an emergency response unless exploitation indicators or threat intelligence emerge.