{"id":"CVE-2026-105582","kind":"vulnerability","aliases":["CVE-2026-105582"],"related":[],"title":"Windows DWM Core Library: invalid pointer release lets a local user gain privileges","description":"Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.","summary":"The Windows Desktop Window Manager (DWM) Core Library releases an invalid pointer or reference. An attacker who already has an account on the machine can use this to elevate their privileges.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:01+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T19:53:57+00:00","updated_at":"2026-11-10T19:53:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DWM Core Library: invalid pointer release lets a local user gain privileges","impact":"high","summary":"The Windows Desktop Window Manager (DWM) Core Library releases an invalid pointer or reference. An attacker who already has an account on the machine can use this to elevate their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105582 to get affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running a Windows build with the affected DWM Core Library, where an authorized local user could be an attacker. The sources do not list affected Windows versions or builds. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":4494,"output_tokens":392,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105582 to get affected Windows builds and the patch.","search":"'-105582':16A,19A '-2026':15A,18A 'account':42B 'allow':64C 'alreadi':39B 'attack':37B,67C 'author':66C 'core':3A,28B,62C 'cve':14A,17A 'desktop':24B 'dwm':2A,27B,61C 'elev':50B,69C 'gain':12A 'infrastructur':20B 'invalid':5A,32B,55C 'let':8A 'librari':4A,29B,63C 'local':10A,71C 'machin':45B 'manag':26B 'pointer':6A,33B,56C 'privileg':13A,52B,70C 'refer':35B,58C 'releas':7A,30B,53C 'use':47B 'user':11A 'window':1A,21B,23B,25B,60C","nicknames":[],"mitigations":[],"who_affected":"Machines running a Windows build with the affected DWM Core Library, where an authorized local user could be an attacker. The sources do not list affected Windows versions or builds. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-105582':16A,19A '-2026':15A,18A 'core':3A 'cve':14A,17A 'dwm':2A 'gain':12A 'invalid':5A 'let':8A 'librari':4A 'local':10A 'pointer':6A 'privileg':13A 'releas':7A 'user':11A 'window':1A","search_b":"'account':42B 'alreadi':39B 'attack':37B 'core':28B 'desktop':24B 'dwm':27B 'elev':50B 'infrastructur':20B 'invalid':32B 'librari':29B 'machin':45B 'manag':26B 'pointer':33B 'privileg':52B 'refer':35B 'releas':30B 'use':47B 'window':21B,23B,25B","search_c":"'allow':64C 'attack':67C 'author':66C 'core':62C 'dwm':61C 'elev':69C 'invalid':55C 'librari':63C 'local':71C 'pointer':56C 'privileg':70C 'refer':58C 'releas':53C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105582","severity":null,"published_at":"2026-11-10T19:18:01+00:00","modified_at":"2026-11-10T19:18:01+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}