Loading vulnerability…
Desktop Window Manager Type Confusion Local Privilege Escalation
CVE-2026-69880 is a type-confusion vulnerability in Microsoft Windows Desktop Window Manager that allows an authorized, low-privileged local attacker to elevate privileges to SYSTEM. The vulnerability involves accessing a resource using an incompatible type. Exploitation has low complexity and requires no user interaction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 7.8. The vulnerable function and affected product versions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants SYSTEM privileges, with high impacts to confidentiality, integrity, and availability. An attacker could use these privileges to access protected information, modify system resources, and disrupt system operation.
Patch, then assume compromise.
Apply the applicable Microsoft security update. An official vendor fix is available, but specific update identifiers, affected versions, and fixed builds are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.