CVE-2026-105582: Windows DWM Core Library Elevation of Privilege Vulnerability

At the core of the advisory is a straightforward warning: Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. While the vulnerability carries an assessment of Exploitation Less Likely and requires high attack complexity, local elevation of privilege bugs in graphics and windowing subsystems remain an essential patch priority for enterprise workstations, multi-user servers, and virtual desktop infrastructure.

Vulnerability Overview: CVE-2026-105582​

Below are the authoritative technical metrics and status indicators published by MSRC for this advisory:

• CVE ID: CVE-2026-105582
• Title: Windows DWM Core Library Elevation of Privilege Vulnerability
• Severity: Important
• CVSS Base Score: 7.0
• CVSS Temporal Score: 6.1
• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-763 (Release of Invalid Pointer or Reference)
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes
• Official Advisory Fact: Windows DWM Core Library Elevation of Privilege Vulnerability: Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Section Summary: CVE-2026-105582 is an Important-rated local elevation of privilege vulnerability in the Windows DWM Core Library (CWE-763) with a 7.0 CVSS base score and 6.1 temporal score. It has not been publicly disclosed or exploited, and official patches are available now.

Technical Analysis: CWE-763 and the CVSS Profile​

To understand why a bug in a graphics compositing library warrants immediate attention, it helps to examine the weakness classification and the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C).

What is CWE-763?​

From general industry knowledge of memory-unsafe systems programming, CWE-763 describes a condition where software attempts to return a memory resource to the heap manager using a pointer or reference that was not properly allocated, points to the middle of a buffer, or belongs to an incompatible memory allocator. When an application or system library releases an invalid pointer, heap metadata can become corrupted. In a privileged or shared system component like the Windows DWM Core Library, an attacker who can carefully groom memory allocations may be able to turn that corruption into arbitrary code execution or privilege escalation.

Breaking Down the CVSS Vector​

Why does this vulnerability score a 7.0 Base rather than a 7.8, despite having High impact ratings across Confidentiality (C:H), Integrity (I:H), and Availability (A:H)?

1. Local Access (AV:L) and Low Privileges (PR:L): The attacker must already be authenticated on the local machine or logged in via a low-privileged session (such as a standard domain user or a compromised application process).
2. No User Interaction (UI:N): Once the attacker has local execution capability, the exploit requires no clicks or prompts from a human user.
3. High Attack Complexity (AC:H): This is the defining constraint that lowers the base score to 7.0 and aligns with Microsoft's Exploitation Less Likely assessment. High attack complexity typically means the attacker must win a precise race condition, bypass memory randomization, or navigate non-deterministic heap states within the DWM process before triggering the invalid pointer release.
4. Temporal Modifiers (E:U/RL:O/RC:C): With unproven exploit maturity (E:U), an official fix available (RL:O), and confirmed report confidence (RC:C), the temporal score drops to 6.1.

Even notice how Windows Server 2019 (Server Core installation) (x64), Windows Server 2022 (Server Core installation) (x64), and Windows Server 2025 (Server Core installation) (x64) are included in the affected product list? Even minimal Server Core installations include core graphics and windowing binaries required by the OS subsystem, making them equally reliant on these cumulative updates.

Section Summary: While high attack complexity (AC:H) makes reliable exploitation difficult, successful exploitation of this CWE-763 invalid pointer release flaw grants high confidentiality, integrity, and availability impact on the affected local system.

Affected Products, KB Updates, and Fixed Builds​

Administrators must apply the appropriate cumulative update to remediate CVE-2026-105582. Note that Windows 11 versions 24H2, 25H2, and 26H2, as well as Windows Server 2025, list two distinct KB and fixed-build pairings in the official MSRC data.

Official Remediation Guidance​

Because Customer action required: Yes is set for CVE-2026-105582, organizations and individual users should deploy the exact update corresponding to their OS architecture and version:

• For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows 10 Version 1809 for x64-based Systems, install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 21H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 21H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 10 Version 22H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 10 Version 22H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 11 Version 23H2 for ARM64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
• For Windows 11 Version 23H2 for x64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
• For Windows 11 Version 24H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
• For Windows 11 Version 24H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
• For Windows 11 Version 25H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
• For Windows 11 Version 25H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
• For Windows 11 Version 26H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
• For Windows 11 Version 26H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
• For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
• For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.

Verifying Your Installation​

After deploying the relevant package (KB5131077, KB5131080, KB5131085, KB5131087, KB5131090, KB5131096, KB5132043, or KB5132061) and completing the required system reboot, you can verify compliance across your fleet using PowerShell:

1. Check the installed hotfix ID:
   Get-HotFix -Id KB5132043, KB5132061, KB5131087, KB5131096, KB5131085, KB5131090, KB5131077, KB5131080 -ErrorAction SilentlyContinue
2. Confirm the OS build number matches or exceeds the fixed build in the table above by running winver or querying the registry (CurrentBuild and UBR under HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion).

Section Summary: Patching across all 22 affected Windows client and server SKUs is straightforward via standard cumulative updates. Prioritize multi-session hosts, jump boxes, and shared workstations during your normal maintenance window to close off this local privilege escalation vector.