CVE-2026-70234: Desktop Window Manager Buffer Over-Read Enables Local Information Disclosure

What happened

Microsoft discovered a buffer over-read in the Desktop Window Manager (DWM) component of Windows. The flaw allows an attacker with local, authorized access to read memory beyond the intended bounds, potentially leaking sensitive information.

Impact

The vulnerability is limited to local attackers who can run code on the target machine. It does not allow remote exploitation or privilege escalation. However, the data exposed could include user credentials, cryptographic keys, or other confidential information stored in memory.

Mitigation

Microsoft released a patch in the latest cumulative update for Windows 10/11. The update replaces the vulnerable DWM implementation with bounds‑checked code.

What to do

• Ensure all Windows systems are updated to the latest cumulative update (KBxxxxxx).
• Verify that the DWM process is running the patched version by checking the file version of dwm.exe.
• Limit local user privileges and enforce least‑privilege policies to reduce the risk of an attacker gaining code execution.
• Monitor for anomalous memory access patterns or unexpected DWM crashes in your SIEM.