---
id: "CVE-2026-105582"
page: "https://infrastack.ai/live/CVE-2026-105582"
kind: "vulnerability"
aliases: ["CVE-2026-105582"]
title: "Windows DWM Core Library: invalid pointer release lets a local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": "10.0.17763.0 - < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": "10.0.19044.0 - < 10.0.19044.7846", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "10.0.19045.0 - < 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "10.0.22631.0 - < 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "10.0.26100.0 - < 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "10.0.26200.0 - < 10.0.26200.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "10.0.26300.0 - < 10.0.26300.9974", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "10.0.20348.0 - < 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "10.0.26100.0 - < 10.0.26100.33822", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["dwm", "infrastructure", "local", "privilege-escalation", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:18:01+00:00"
first_seen_at: "2026-11-10T19:24:21+00:00"
updated_at: "2026-11-11T00:52:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105582", "first_seen_at": "2026-11-10T19:24:21+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-105582", "first_seen_at": "2026-11-11T00:52:45+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-105582"]}]
exploit_sources: []
---

# Windows DWM Core Library: invalid pointer release lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-105582 (this .md is for agents)

The Windows Desktop Window Manager (DWM) Core Library releases an invalid pointer or reference. An attacker who already has an account on the machine can use this to elevate their privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 1809 / Server 2019 affected 10.0.17763.0 - < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows 10 21H2 affected 10.0.19044.0 - < 10.0.19044.7846 fixed 10.0.19044.7846
- microsoft:Windows 10 22H2 affected 10.0.19045.0 - < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows 11 23H2 affected 10.0.22631.0 - < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 11 24H2 affected 10.0.26100.0 - < 10.0.26100.9974 fixed 10.0.26100.9974
- microsoft:Windows 11 25H2 affected 10.0.26200.0 - < 10.0.26200.9974 fixed 10.0.26200.9974
- microsoft:Windows 11 26H2 affected 10.0.26300.0 - < 10.0.26300.9974 fixed 10.0.26300.9974
- microsoft:Windows Server 2022 affected 10.0.20348.0 - < 10.0.20348.5870 fixed 10.0.20348.5870
- microsoft:Windows Server 2025 affected 10.0.26100.0 - < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the full build (e.g. 10.0.26100.xxxx) with the fixed builds: Win10 1809/Server 2019 17763.9487; Win10 21H2 19044.7846; Win10 22H2 19045.7846; Win11 23H2 22631.7711; Win11 24H2 26100.9974; Win11 25H2 26200.9974; Win11 26H2 26300.9974; Server 2022 20348.5870; Server 2025 26100.33822.

## Fix

Install the November 2026 Windows cumulative update that brings the build to at least the fixed build for your version (see products). KB numbers not confirmed.

## Timeline

- 2026-11-10T19:24:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105582
- 2026-11-11T00:52:45+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-105582 — MSRC page not readable by tools; affected builds taken from Microsoft CNA data as shown on NVD. Not marked verified. No exploitation or PoC found; not in KEV. Patch is the November 2026 cumulative update, exact KB unknown.

## Documents

- [describes] NVD CVE-2026-105582 (Microsoft CNA affected builds) https://nvd.nist.gov/vuln/detail/cve-2026-105582

## From the sources

Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_