CVE-2026-44802

What it actually does

CVE-2026-44802 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Desktop Window Manager Core Library. An attacker who already has valid local access can trigger unsafe reuse of freed memory in the DWM component to execute code with elevated privileges. Successful exploitation can allow escalation from a low-privileged user context to a highly privileged local context, potentially enabling full compromise of the affected Windows host. The vulnerability affects multiple supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025.

Why it matters to the business

This flaw can turn an initial foothold on a Windows machine into full local control of that system. While it is not remotely exploitable by itself and requires the attacker to already be able to run code locally, it is valuable in real intrusions because it can be chained after phishing, malware execution, stolen credentials, or exploitation of another vulnerability. Compromise of privileged access on endpoints or servers can lead to credential theft, security tool tampering, lateral movement, data theft, service disruption, and persistence. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at the time of assessment, but the CVSS 7.8 severity and broad Windows exposure make timely patching important.

How an attack unfolds

An attacker first obtains local access to an affected Windows system, typically through malware execution, a compromised user account, malicious document execution, or another initial-access technique. From that low-privileged context, the attacker runs exploit code that interacts with the Desktop Window Manager functionality in a way that triggers the use-after-free condition. By shaping memory around the freed object, the attacker may cause DWM-related code to operate on attacker-controlled data, resulting in elevated code execution. Once elevated, the attacker can disable defenses, dump credentials, install persistence, create or modify privileged accounts, access protected files, and use the host as a staging point for broader compromise.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-44802 for all affected Windows versions. Because no specific fixed build numbers were provided, administrators should deploy the applicable June 2026 or later cumulative update from Microsoft for Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Prioritize internet-facing servers, shared workstations, jump hosts, VDI images, administrator workstations, and systems used by privileged users. Where immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary administrative privileges, enforcing application control, enabling endpoint protection, restricting script execution, and monitoring for local privilege escalation behavior. Mitigations should be treated as temporary; patching is the primary remediation.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative security update released on or after the vendor fix date for this vulnerability. Use centralized patch management, vulnerability scanning, Microsoft Defender Vulnerability Management, Windows Update for Business, WSUS, or equivalent tooling to verify update compliance across all supported Windows client and server versions. Validate that build numbers and installed hotfixes correspond to the patched cumulative update level. Re-scan assets after patch deployment and confirm the vulnerability is no longer reported. For gold images, VDI templates, offline server images, and recovery images, verify that the patched cumulative update is integrated so newly provisioned systems are not reintroduced in a vulnerable state.

Typical attack path

1. Gain local code execution on an affected Windows workstation or server using phishing, malware, stolen credentials, or another vulnerability.
2. Run a local privilege-escalation exploit targeting the Windows DWM Core Library use-after-free condition.
3. Trigger memory corruption in the Desktop Window Manager component and obtain elevated local execution.
4. Use elevated privileges to disable security controls, access protected files, dump credentials, or modify system configuration.
5. Establish persistence and attempt lateral movement to additional systems using harvested credentials or administrative tooling.

How to detect it

Detection should focus on signs of exploitation and post-exploitation rather than a unique network indicator, because this is a local privilege escalation issue and no public exploit indicators are provided. Review Windows Security logs, Sysmon telemetry, EDR alerts, Windows Error Reporting, and application/system event logs for unusual activity around the time a low-privileged user process gains administrative or SYSTEM-level execution. Look for crashes or abnormal behavior involving Desktop Window Manager, followed by suspicious elevated process creation, service installation, scheduled task creation, credential access attempts, or security control tampering. Useful log sources include Windows Security events for process creation and privilege use, Sysmon events for process creation and process access, EDR memory-exploitation alerts, Windows Error Reporting events for dwm.exe crashes, Service Control Manager events for new services, and task scheduler operational logs. Because DWM is a normal Windows component, dwm.exe alone is not an indicator of compromise; prioritize correlations such as a DWM crash followed by an unexpected SYSTEM shell, suspicious child processes, credential dumping tools, or changes to local administrators.

What your security team should do

• Prioritize deployment of the applicable Microsoft cumulative update across affected Windows endpoints and servers, especially systems used by administrators or exposed to untrusted users.
• Use endpoint management and vulnerability scanning to identify Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems missing the relevant security update.
• Review recent endpoint telemetry for suspicious local privilege escalation patterns, including unexpected elevated process creation following execution from user-writable directories.
• Harden systems by enforcing least privilege, removing unnecessary local administrator rights, enabling application control, and restricting untrusted executable/script execution.
• Monitor for post-exploitation behavior such as credential dumping, LSASS access, suspicious service creation, security tool tampering, new local administrator accounts, and unusual use of administrative utilities.
• Ensure incident response playbooks account for local privilege escalation vulnerabilities being chained after initial access, even when public exploit maturity is currently listed as none.