TL;DR

A critical local privilege escalation vulnerability in Microsoft's Desktop Window Manager can be exploited by an attacker with low-privileged code execution rights to gain higher-level permissions on a Windows system.

What happened

['Local attackers can exploit use-after-free issue in DWM to escalate privileges']

Why it matters for ops

['Attackers can obtain high-level access after gaining initial foothold', 'Vulnerability allows for privilege escalation from low-privileged user']

Mitigation

  • Apply Microsoft security updates
  • Limit access rights for low-privileged users

Action items

  • Update affected systems with latest patches from Microsoft

Detection IOCs

  • Unexpected system crashes or instability due to DWM process errors
  • Unusual activity by user accounts with elevated permissions without proper authorization

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-044/