CVE-2026-25189
Published: 10 March 2026
Summary
CVE-2026-25189 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-25189 by requiring identification, reporting, and timely application of the Microsoft patch for the use-after-free flaw in Windows DWM Core Library.
Provides memory protection safeguards such as DEP and ASLR that mitigate exploitation of the use-after-free vulnerability to unauthorized code execution and privilege escalation.
Vulnerability scanning detects the presence of CVE-2026-25189 in Windows systems, enabling analysis and remediation to prevent local privilege escalation attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Windows DWM Core Library directly enables local privilege escalation via exploitation (T1068).
NVD Description
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-25189 is a use-after-free vulnerability (CWE-416) in the Windows DWM Core Library. This flaw affects Windows systems and was published on 2026-03-10 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows the attacker to elevate privileges on the affected system.
Microsoft's update guide provides details on the vulnerability, including mitigation and patch information, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25189.
Details
- CWE(s)