Loading story…
Microsoft addressed CVE-2026-20805, a Windows Desktop Window Manager (DWM) vulnerability, in its January 2026 security updates. Patch analysis identified a use-after-free condition in dwmcore.dll: the CSynchronousSuperWetInk destructor could free an object while CSuperWetInkManager retained a reference, leaving a dangling pointer for later use during DWM rendering.
A low-privileged application can reportedly trigger the flaw through DirectComposition and reclaim the released heap allocation, potentially achieving code execution in the DWM process at SYSTEM integrity. Microsoft corrected the object-lifetime handling by conditionally enabling feature flag Feature_1732988217, which ensures RemoveSource() is called; organizations should apply the January 2026 Windows security updates across supported endpoints.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft addressed a use-after-free flaw in the Windows Desktop Window Manager's dwmcore.dll during the January 2026 Patch Tuesday release. The fix adds Feature_1732988217 and unconditionally removes the object from CSuperWetInkManager during destruction, preventing a stale pointer from being retained.
Elastic Security Labs analyzed the vulnerable and patched DWM binaries and described how a low-privileged application could trigger the DirectComposition flaw, reclaim the freed allocation, and execute code in dwm.exe at System integrity. The analysis identified vulnerable version 10.0.26100.7309 and patched version 10.0.26100.7623.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcelearn.microsoft.com
Open sourceibm.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has issued security advisories for multiple **Desktop Window Manager (DWM) Core Library** elevation-of-privilege vulnerabilities affecting Windows, including `CVE-2022-21902`, `CVE-2022-41096`, `CVE-2024-43629`, `CVE-2025-21304`, and `CVE-2025-53801`. The flaws were published across several update cycles through the Microsoft Security Response Center, indicating a recurring security issue in the component responsible for Windows desktop composition and rendering. The advisories identify the vulnerabilities as **elevation of privilege** issues in the Windows or Microsoft DWM Core Library, meaning successful exploitation could allow an attacker with existing access to gain higher privileges on a targeted system. Microsoft released fixes through its Security Update Guide and related portal advisories, making patching a priority for organizations that rely on Windows endpoints and servers where the DWM component is present.
Jul 12, 2026
Microsoft published security updates for multiple Windows elevation-of-privilege vulnerabilities affecting the **TDI Translation Driver** (``tdx.sys``) and the **DWM Core Library**. The disclosures include **CVE-2026-27908** and **CVE-2026-27921** in ``tdx.sys``, **CVE-2026-25189** in the DWM Core Library, and an earlier related TDI Translation Driver issue, **CVE-2025-49659**. Microsoft classified the flaws as local privilege-escalation bugs that could let an authenticated attacker gain higher privileges on a vulnerable system. Microsoft said **CVE-2026-27908** is a **use-after-free** vulnerability tracked as **CWE-416** with a **CVSS 3.1 score of 7.0**, and warned exploitation is **more likely** despite requiring high attack complexity because the attacker must win a race condition. The company stated the issue was **not publicly disclosed** and **not exploited in the wild** at publication, and credited **Angelboy (@scwuaptx) of DEVCORE** for reporting it. Fixes were made available through the Microsoft Security Update Guide for all listed vulnerabilities.
Jun 29, 2026
Microsoft released fixes for several **Windows elevation-of-privilege vulnerabilities** affecting **Win32k**, **Windows Telephony Service**, **Desktop Window Manager**, and the **Windows Cloud Files Mini Filter Driver**. The disclosed flaws include `CVE-2026-34347`, `CVE-2026-42825`, `CVE-2026-27923`, and `CVE-2026-35418`, and are all tied to **use-after-free** conditions, with some cases also involving race conditions such as time-of-check time-of-use behavior. Microsoft said successful exploitation could let a locally authenticated attacker with low privileges gain **SYSTEM** access without user interaction. The vulnerabilities were rated **Important** with **CVSS 3.1 scores ranging from 7.0 to 7.8**, and Microsoft assessed exploitation as **less likely or unlikely** because several attacks require winning a race condition. At the time of disclosure, Microsoft reported **no public disclosure and no evidence of active exploitation** for the documented 2026 flaws, and stated that official security updates were available. Additional Microsoft advisories also reference related Windows and Microsoft Brokering File System elevation-of-privilege issues, including `CVE-2026-24285`, `CVE-2025-32712`, `CVE-2025-21372`, `CVE-2025-21315`, and `CVE-2025-59189`, though public technical details for those entries were limited.
Jun 29, 2026