CVE-2026-45637

What it actually does

CVE-2026-45637 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Desktop Window Manager Core Library. An attacker who already has valid local code execution with low privileges can trigger improper object lifetime handling in DWM-related functionality, causing freed memory to be reused in a controlled way. Successful exploitation can allow code execution with elevated privileges on the affected Windows system, compromising confidentiality, integrity, and availability. The vulnerability is local-only, requires low privileges, requires no user interaction, and affects multiple supported Windows client and server releases including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025.

Why it matters to the business

If exploited, this flaw can turn an initial low-privilege foothold into full control of a Windows workstation or server. That can allow attackers to disable security tools, steal credentials, move laterally, deploy malware, tamper with business data, or disrupt operations. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no known mature public exploit based on the provided data, which lowers immediate internet-scale urgency; however, local privilege escalation bugs are commonly chained with phishing, malware, remote code execution, or stolen credentials, so broad Windows exposure makes timely patching important.

How an attack unfolds

An attacker first obtains the ability to run code locally on an affected Windows system, such as through malware execution, a compromised user account, exploitation of another vulnerability, or abuse of remote access. The attacker then runs a crafted exploit that interacts with Desktop Window Manager components in a way that triggers the use-after-free condition in the DWM Core Library. By carefully shaping memory after the vulnerable object is freed, the attacker attempts to redirect execution or manipulate privileged state. If successful, the attacker gains elevated privileges on the local machine. With those privileges, the attacker can dump credentials, install persistence, tamper with endpoint defenses, access protected files, create or modify privileged accounts, and use the host as a staging point for further intrusion.

How to fix it

Apply the relevant Microsoft security updates or latest cumulative updates for all affected Windows versions: Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No exact fixed build numbers were provided, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or an equivalent patch management platform to deploy the latest security baseline for each supported release. Prioritize systems where untrusted users can log on interactively, shared workstations, virtual desktop infrastructure, jump hosts, developer workstations, and servers that permit remote desktop or delegated administration. Where immediate patching is not possible, reduce exposure by limiting local logon rights, restricting Remote Desktop access, enforcing least privilege, blocking unknown executable execution with application control, and monitoring for DWM crashes or suspicious post-exploitation behavior.

How to confirm the fix worked

Confirm that affected systems have installed the applicable Microsoft cumulative security update released after the vulnerability disclosure date of 2026-06-09. Validate through Windows Update history, enterprise patch reporting, or commands such as `Get-HotFix` and operating system build inventory. Ensure all supported Windows 10, Windows 11, and Windows Server versions are at a patched build level according to the current Microsoft Security Update Guide. For exposure validation, inventory systems running the listed affected Windows releases and identify those missing current cumulative updates. For mitigation validation, confirm that standard users do not have unnecessary local administrator rights, Remote Desktop access is limited, endpoint protection is active, and application control or attack surface reduction policies are enforced where appropriate.

Typical attack path

1. Gain initial low-privilege access to an affected Windows client or server.
2. Execute a local exploit targeting the DWM Core Library use-after-free condition.
3. Trigger the vulnerable Desktop Window Manager code path to free and later reuse an object incorrectly.
4. Manipulate memory layout so the freed object is replaced with attacker-controlled data.
5. Achieve local privilege escalation and run code with elevated privileges.
6. Use elevated access to disable defenses, harvest credentials, establish persistence, or move laterally.

How to detect it

There is no single definitive log entry that proves exploitation of this vulnerability, and the provided intelligence does not indicate known public exploit maturity or active KEV-listed exploitation. Detection should focus on correlated host behavior: crashes or faults in Desktop Window Manager components followed by privilege escalation, suspicious process execution, credential access, persistence creation, or defense evasion. Review Windows Application logs, System logs, Security logs, Windows Error Reporting artifacts, endpoint detection telemetry, crash dumps, Sysmon events, and EDR process trees. Look for `dwm.exe` crashes referencing `dwmcore.dll`, repeated application fault events, unusual execution of unknown binaries by low-privilege users, creation of new local administrators, service creation shortly after DWM instability, suspicious token manipulation, LSASS access, security product tampering, and unexpected command shells or scripting engines launched in close temporal proximity. Useful Windows events include Security 4624, 4672, 4688, 4697, 4720, 4728, 4732, 7045 from System Service Control Manager, Application Error event 1000, and Windows Error Reporting event 1001. If crash dumps are retained, examine dumps involving `dwm.exe` and `dwmcore.dll` for signs of memory corruption or exploit-like heap grooming. Prioritize hunts on unpatched systems and systems where users have interactive or RDP logon capability.

• dwm.exe
• dwmcore.dll
• Application Error
• Faulting application name: dwm.exe
• Faulting module name: dwmcore.dll
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Display Window Manager
• Desktop Window Manager
• Service Control Manager 7045
• A service was installed in the system
• Special privileges assigned to new logon
• Event ID 4672
• A new process has been created
• Event ID 4688
• A user account was created
• Event ID 4720
• A member was added to a security-enabled global group
• Event ID 4728
• A member was added to a security-enabled local group
• Event ID 4732
• C:\Windows\System32\dwm.exe
• C:\Windows\System32\dwmcore.dll
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue

What your security team should do

• Deploy the latest Microsoft cumulative security updates to affected Windows clients and servers, prioritizing interactive user systems, RDP-accessible systems, VDI, jump hosts, and high-value administrative workstations.
• Inventory all Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and identify those missing security updates released after 2026-06-09.
• Treat this as a privilege-escalation risk that may be chained with malware, phishing, remote access compromise, or other code execution vulnerabilities.
• Harden local privilege boundaries by removing unnecessary local administrator rights and limiting interactive or remote logon permissions.
• Enable and monitor Windows Event Logs, Sysmon or equivalent EDR telemetry, Windows Error Reporting, and endpoint protection alerts for DWM crashes followed by suspicious elevated activity.
• Hunt for signs of local exploitation, including repeated `dwm.exe` crashes, abnormal memory faulting in `dwmcore.dll`, sudden privilege changes, suspicious service creation, credential dumping attempts, and security tool tampering.
• Use application control, attack surface reduction rules, and controlled folder access where feasible to reduce the chance that a low-privilege user can execute an exploit binary.
• Because the vulnerability is not currently KEV-listed and EPSS is low, schedule remediation through normal high-severity patch SLAs, but accelerate patching for exposed or high-impact systems.