CVE-2026-21519
Published: 10 February 2026
Description
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the type confusion vulnerability in Desktop Window Manager by requiring timely application of Microsoft patches as emphasized in the CVE analysis and CISA KEV catalog.
Implements memory protections like ASLR, DEP, and CFG that mitigate exploitation of type confusion leading to local privilege escalation.
Enforces least privilege for low-privilege local accounts, limiting the potential impact and scope of successful privilege escalation via the DWM vulnerability.
Security SummaryAI
CVE-2026-21519 is a type confusion vulnerability (CWE-843), classified as an access of resource using incompatible type, affecting the Desktop Window Manager (DWM) component in Microsoft Windows. Published on February 10, 2026, it carries a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability when exploited.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation enables privilege escalation, potentially granting the attacker high-level access to the system, compromising sensitive data, modifying critical files, or disrupting system operations.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 provides details on patches and mitigation steps. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21519, confirming active exploitation in the wild and urging federal agencies to apply mitigations promptly.
Security practitioners should prioritize patching affected Windows systems, as real-world exploitation has been observed, emphasizing the need for immediate updates to DWM to prevent local privilege escalation attacks.
Details
- CWE(s)
- KEV Date Added
- 10 February 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-21519 is a local privilege escalation vulnerability exploitable by low-privileged attackers via type confusion in DWM, directly enabling T1068: Exploitation for Privilege Escalation.