CVE-2026-42905

What it actually does

CVE-2026-42905 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Desktop Window Manager Core Library. A low-privileged, authenticated local attacker can trigger incorrect object lifetime handling in the DWM component and potentially execute code with elevated privileges. Because the CVSS vector is local, low complexity, low privilege required, and no user interaction required, the flaw is most relevant after an attacker has already obtained code execution as a standard user on an affected Windows workstation or server. Successful exploitation can provide high confidentiality, integrity, and availability impact by allowing the attacker to bypass normal Windows privilege boundaries.

Why it matters to the business

If exploited, this vulnerability can allow an attacker who already has a foothold on a Windows system to gain administrative or SYSTEM-level control, making it easier to disable security tools, steal credentials, install persistence, access sensitive data, and move laterally. The affected product range spans many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so exposure may be broad in organizations with mixed Windows fleets. It is not currently listed in CISA KEV, has no known ransomware association in the provided data, and the EPSS score is low and flat at approximately 2.0% over 30 days, but local privilege escalation bugs are commonly chained with phishing, drive-by compromise, stolen credentials, or remote-code-execution vulnerabilities.

How an attack unfolds

An attacker first needs local authenticated access to an affected Windows system, typically through malware execution, a compromised user account, remote access abuse, or another vulnerability that provides initial code execution. The attacker then runs a crafted program that interacts with Desktop Window Manager functionality in a way that triggers the use-after-free condition in the DWM Core Library. By carefully shaping memory before and after the freed object is reused, the exploit attempts to redirect execution or corrupt privileged state. If successful, the attacker elevates from a normal user context to a highly privileged context and can then perform post-exploitation actions such as dumping credentials, tampering with endpoint defenses, creating privileged accounts, installing services, or staging lateral movement. No public exploit maturity is indicated in the provided data, but the vulnerability characteristics make it useful as a post-compromise escalation primitive.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42905 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or your normal patch management tooling to deploy the applicable cumulative update released on or after the June 2026 security update cycle. Prioritize internet-facing servers that allow interactive logon, VDI and RDS hosts, developer workstations, administrator workstations, kiosks, and systems used by privileged users. If immediate patching is not possible, reduce risk by limiting local interactive access, enforcing least privilege, removing unnecessary local administrator rights, enabling Credential Guard and LSASS protection where applicable, restricting untrusted executable execution with application control, and monitoring for suspicious local privilege escalation behavior. Mitigations should not be treated as a substitute for patching.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows endpoints have installed the applicable Microsoft cumulative security update released on or after the patch date for this vulnerability. Use enterprise patch management reports, Windows Update history, or PowerShell-based inventory to validate update compliance across all affected Windows 10, Windows 11, and Windows Server versions. Where Microsoft publishes specific KBs or build numbers for this issue, compare each asset against those fixed baselines. Validate that standard users cannot write to privileged locations, create privileged services, or obtain elevated tokens through local testing. For exposure checks, inventory systems by OS version and patch level, then identify devices missing the relevant June 2026-or-later security update. For high-risk hosts, review Windows Event Logs and EDR telemetry for DWM crashes, unusual child process behavior, suspicious token elevation, unexpected service creation, and post-exploitation activity around the time a low-privileged process interacted with desktop/windowing components.

Typical attack path

1. Gain initial access to an affected Windows workstation or server as a low-privileged authenticated user.
2. Transfer or generate a local exploit binary or script designed to trigger the DWM Core Library use-after-free condition.
3. Execute the exploit locally without requiring additional user interaction.
4. Manipulate memory layout to achieve reliable corruption of the freed DWM-related object.
5. Obtain elevated privileges, commonly targeting administrator or SYSTEM-level execution.
6. Use elevated access to disable defenses, access protected data, dump credentials, create persistence, or move laterally.

How to detect it

Look for evidence that a low-privileged local process triggered instability or abnormal behavior in Desktop Window Manager components followed by privilege escalation or post-exploitation activity. Relevant log sources include Windows Application logs for dwm.exe or dwmcore.dll crashes, Windows System logs for service creation and driver/service failures, Security logs for new privileged logons and local group membership changes, Sysmon or EDR telemetry for process creation, token elevation, suspicious handle access, and file writes to user-writable paths followed by elevated execution. Useful behavioral patterns include repeated dwm.exe crashes, a user-level process running immediately before a DWM crash, creation of a new service by a non-administrative user context, unexpected spawning of cmd.exe, powershell.exe, wscript.exe, rundll32.exe, regsvr32.exe, or other living-off-the-land tools with elevated integrity, changes to the local Administrators group, attempts to dump LSASS, and disabling of security controls. Since no public exploit indicators or actor-specific tradecraft were provided, treat DWM crash artifacts as weak signals and correlate them with privilege changes and post-exploitation behavior rather than alerting on crashes alone.

• Faulting application name: dwm.exe
• Faulting module name: dwmcore.dll
• Display Window Manager stopped working and was closed
• Windows Error Reporting: dwm.exe
• Application Error: dwm.exe
• Application Error: dwmcore.dll
• The Desktop Window Manager has exited with code
• Event ID 1000
• Event ID 1001
• Event ID 7036
• Event ID 7045
• A service was installed in the system
• net localgroup administrators
• lsass.exe
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump
• reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
• sc.exe create
• powershell.exe -EncodedCommand

What your security team should do

• Patch affected Windows client and server systems with the applicable Microsoft security update as part of the next expedited endpoint and server patch cycle.
• Prioritize systems used by administrators, RDS/VDI infrastructure, jump hosts, developer endpoints, and servers where local user access is possible.
• Use asset inventory to find affected Windows 10, Windows 11, and Windows Server versions that have not received the relevant cumulative update.
• Hunt for signs of local privilege escalation, including suspicious service creation, new local administrators, abnormal token elevation, credential dumping attempts, and DWM-related crashes followed by privileged process activity.
• Restrict execution of untrusted binaries using Microsoft Defender Application Control, AppLocker, or equivalent controls, especially on servers and privileged workstations.
• Enforce least privilege by removing unnecessary local administrator rights and limiting interactive logon to servers.
• Ensure EDR policies alert on privilege escalation behaviors such as access to LSASS, shadow copy abuse, security tool tampering, and creation of services from user-writable paths.
• Because this is not currently KEV-listed and exploit maturity is reported as none, balance urgency with broader patch priorities, but do not defer indefinitely because local privilege escalation flaws are frequently used in exploit chains.