Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.
Security updates
10.0.26100.32860 — https://support.microsoft.com/help/5087539
10.0.26100.32772 — https://support.microsoft.com/help/5087423
10.0.26200.8457 — https://support.microsoft.com/help/5089549
10.0.26200.8390 — https://support.microsoft.com/help/5089466
10.0.28000.2113 — https://support.microsoft.com/help/5089548
Vulnerabilities 1
-
Medium 5.5
Windows DWM Core Library Information Disclosure Vulnerability
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Revision history
-
#3
This CVE has been discovered to be an Elevation of Privilege and not an Information Disclosure. The CVE's Impact has been updated.
-
#1
Information published.
-
#2
Information published. This CVE was addressed by updates that were released in May 2026, but the CVE was inadvertently omitted from the May 2026 Security Updates. This is an informational change only. Customers who have already installed the May 2026 updates do not need to take any further action.
References
-
CVE-2026-48566 Windows DWM Core Library Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48566
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss