CVE-2025-30400: Windows DWM use-after-free allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and yields full local privilege escalation, though it requires an existing low-privileged foothold rather than remote reach.

What it is

CVE-2025-30400 is a use-after-free (CWE-416) in the Windows Desktop Window Manager (DWM) core library. A locally authenticated attacker can trigger the flaw to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. Because DWM is a core desktop component present on essentially all supported Windows builds, the affected base is broad.

Impact

Successful exploitation gives the attacker elevated privileges on the local machine, with high impact to confidentiality, integrity and availability per the CVSS vector. This typically means moving from a standard user to SYSTEM or administrative context.

Attack surface

Reached locally (AV:L) with low attack complexity, requiring low privileges (PR:L) and no user interaction (UI:N). The attacker must already have code execution or an interactive session on the target host.

Exploitation

CVE-2025-30400 was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-13 with a remediation due date of 2025-06-03, indicating exploitation in the wild. EPSS 30-day probability is 0.019 (78.6th percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-30400 across all affected Windows 10, Windows 11 and Windows Server builds.
• Prioritize patching internet-facing and multi-user systems, and meet the CISA KEV due date of 2025-06-03.
• Restrict and monitor local interactive logon and remote access so untrusted users cannot obtain the low-privileged foothold the exploit requires.
• Where patching is delayed, follow vendor instructions and BOD 22-01 guidance for cloud services, or discontinue use of unmitigated systems.
• Track unpatched endpoints against the affected product list and enforce patch compliance reporting.

Detection

• Monitor for unexpected privilege escalation to SYSTEM or administrative tokens originating from DWM-related processes.
• Alert on suspicious process creation where a low-privileged process spawns a high-integrity child, especially near dwm.exe activity.
• Correlate local logon events with subsequent privileged process creation on the same host within a short window.
• Review endpoint telemetry for crashes or anomalous memory behavior in DWM core library components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.