{"id":"CVE-2026-105528","kind":"vulnerability","aliases":["CVE-2026-105528"],"related":[],"title":"Windows Desktop Window Manager: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Desktop Window Manager, the Windows component that composes application windows, has a heap-based buffer overflow. A signed-in attacker with an account on the machine can use it to elevate their privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Desktop Window Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop-window-manager","infrastructure","multi-user-systems","windows"],"not_affected_if":["no-local-accounts-untrusted"],"how_to_check":"- Check the Windows build and update level with `winver` and compare it against the Microsoft security update for CVE-2026-105528 (unknown: the sources do not list affected builds)\n- Check whether the machine is patched via Windows Update history (unknown: the sources do not say which update fixes it)","fix":null,"status":"open","published_at":"2026-11-10T19:17:52+00:00","first_seen_at":"2026-11-10T19:24:18+00:00","triaged_at":"2026-11-10T19:42:37+00:00","updated_at":"2026-11-10T19:42:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: heap overflow lets a local user gain higher privileges","impact":"high","summary":"Desktop Window Manager, the Windows component that composes application windows, has a heap-based buffer overflow. A signed-in attacker with an account on the machine can use it to elevate their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop-window-manager","multi-user-systems"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains higher system privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft fix/KB from the NVD or MSRC entry for CVE-2026-105528.","how_to_check":"- Check the Windows build and update level with `winver` and compare it against the Microsoft security update for CVE-2026-105528 (unknown: the sources do not list affected builds)\n- Check whether the machine is patched via Windows Update history (unknown: the sources do not say which update fixes it)","plain_action":"","product_name":"Desktop Window Manager","needs_analyst":true,"not_affected_if":["no-local-accounts-untrusted"],"who_is_affected":"Affects Windows machines where a user can sign in locally, so the risk is to shared or multi-user systems and to any attacker who already has a foothold on a machine. The sources do not list affected Windows builds or the patched update, so the exposed range is unknown. Single-user machines with only trusted accounts are lower priority but still need the vendor update once it is available.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4494,"output_tokens":610,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft fix/KB from the NVD or MSRC entry for CVE-2026-105528.","search":"'-105528':16A,19A '-2026':15A,18A 'account':57B 'allow':77C 'applic':41B 'attack':54B,80C 'author':79C 'base':47B,70C 'buffer':48B,71C 'compon':38B 'compos':40B 'cve':14A,17A 'desktop':2A,20A,24B,33B,74C 'desktop-window-manag':23B 'elev':65B,82C 'gain':11A 'heap':5A,46B,69C 'heap-bas':45B,68C 'higher':12A 'infrastructur':27B 'let':7A 'local':9A,84C 'machin':60B 'manag':4A,26B,35B,76C 'manager':22A 'multi':29B 'multi-user-system':28B 'overflow':6A,49B,72C 'privileg':13A,67B,83C 'sign':52B 'signed-in':51B 'system':31B 'use':62B 'user':10A,30B 'window':1A,3A,21A,25B,32B,34B,37B,42B,75C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines where a user can sign in locally, so the risk is to shared or multi-user systems and to any attacker who already has a foothold on a machine. The sources do not list affected Windows builds or the patched update, so the exposed range is unknown. Single-user machines with only trusted accounts are lower priority but still need the vendor update once it is available.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["desktopwindowmanager","windowmanager"],"ptokens":["desktop","manager","window"],"labels":["desktopwindowmanager","high","infrastructure","multiusersystems","vendor","windows"],"campaign_type":null,"search_a":"'-105528':16A,19A '-2026':15A,18A 'cve':14A,17A 'desktop':2A,20A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'manag':4A 'manager':22A 'overflow':6A 'privileg':13A 'user':10A 'window':1A,3A,21A","search_b":"'account':57B 'applic':41B 'attack':54B 'base':47B 'buffer':48B 'compon':38B 'compos':40B 'desktop':24B,33B 'desktop-window-manag':23B 'elev':65B 'heap':46B 'heap-bas':45B 'infrastructur':27B 'machin':60B 'manag':26B,35B 'multi':29B 'multi-user-system':28B 'overflow':49B 'privileg':67B 'sign':52B 'signed-in':51B 'system':31B 'use':62B 'user':30B 'window':25B,32B,34B,37B,42B","search_c":"'allow':77C 'attack':80C 'author':79C 'base':70C 'buffer':71C 'desktop':74C 'elev':82C 'heap':69C 'heap-bas':68C 'local':84C 'manag':76C 'overflow':72C 'privileg':83C 'window':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105528","severity":null,"published_at":"2026-11-10T19:17:52+00:00","modified_at":"2026-11-10T19:17:52+00:00","first_seen_at":"2026-11-10T19:24:18+00:00","fetched_at":"2026-11-10T19:24:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}