CVE-2026-32152
Published: 14 April 2026
Summary
CVE-2026-32152 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32152 is a use-after-free vulnerability (CWE-416) in the Desktop Window Manager (DWM), a core Windows component responsible for compositing windows and rendering the desktop environment. Published on April 14, 2026, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized local attacker possessing low privileges. Exploitation requires only local access and low complexity, with no user interaction needed. Successful attacks enable privilege escalation, granting high-level impacts on confidentiality, integrity, and availability.
Microsoft's advisory provides mitigation guidance, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32152. Security practitioners should consult this update guide for details on applicable patches and remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22537
Vulnerability details
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in privileged DWM component directly enables local privilege escalation via memory corruption exploitation (CWE-416, AV:L, high impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in Desktop Window Manager by identifying, testing, and deploying vendor patches.
Implements memory protection techniques like address space randomization and non-executable memory that directly mitigate exploitation of use-after-free vulnerabilities.
Enforces least privilege for processes and users, limiting the impact and success potential of local privilege escalation attempts via the DWM vulnerability.