Microsoft’s July 14 patch fixes DWM bug that leaks secrets to any logged-in user

Microsoft released its monthly security updates on July 14, 2026, and hidden inside the routine Patch Tuesday payload is a fix for CVE-2026-50437, an information disclosure flaw in the Windows Desktop Window Manager (DWM) Core Library. The bug, rated Important with a CVSS score of 5.5, lets a locally authenticated attacker read data beyond an intended memory boundary—and it requires no interaction from the victim beyond simply being logged in.

If you manage Windows machines, or even just use one, this update isn’t optional. It closes a door that, once an intruder has a toehold on your system, could let them silently vacuum up passwords, encryption keys, or other sensitive data sitting in memory.

What the July update actually changes

The patch, delivered through the standard cumulative update channel, advances the OS build numbers for every supported Windows edition past a set of minimum thresholds. Install it, and the DWM Core Library's out-of-bounds read bug is plugged. Skip it, and your system remains open to a low-complexity local attack that Microsoft itself confirms carries a “High” confidentiality impact.

The vulnerable releases and their corrected builds are:

For Windows Server 2025, the fix comes via update KB5099536. Notably, the vulnerability also affects Server Core installations of Windows Server 2016, 2019, and 2025. That’s a gotcha for admins who assume a headless server without the full desktop experience is immune—the DWM Core Library is a core Windows component, present even when the graphical shell is minimal.

The underlying weakness, tracked as CWE-125, is an out-of-bounds read. In practice, that means the DWM process accesses memory outside the buffer it should be working with. The leaked data could include fragments of whatever else is sitting in memory at that moment: credentials, clipboard contents, encryption keys, or other sensitive information.

Why this matters for home users and IT pros alike

At first glance, a local-only attack with a “mere” 5.5 CVSS score might not set off alarm bells. But the devil is in the details. Microsoft’s CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. In plain English: an attacker needs physical or remote desktop access to the machine and a standard user account (no admin rights), but then the attack is trivially easy—low complexity, no user interaction required. The damage is confined to snooping, but what the attacker can read is rated “High” in severity.

Think about shared workstations, developer boxes, remote desktop session hosts, or even a home PC that’s been compromised by a separate infostealer. Once the bad guy has a foothold as a limited user, this DWM flaw becomes a quiet data siphon that runs without tripping any alarm bells.

For home users, the takeaway is straightforward: install the July 14 update. You might not think you’re a target, but malware often chains together multiple vulnerabilities. A low-severity local bug like this can be the final piece that lets an attacker extract your saved passwords from a password manager’s memory or scoop up authentication tokens.

For IT administrators, the equation is simple but urgent. The attack vector requires local access, which means it’s most dangerous inside an already-compromised network. Ransomware groups, for instance, often lurk on endpoints for days or weeks, harvesting credentials. A tool like this could accelerate lateral movement. And because it’s a core OS component, there’s no practical workaround: disabling DWM or killing the dwm.exe process will either crash the graphical interface or be automatically reversed by the system. The only fix is the patch.

A decade-old graphics engine with a fresh crack

The Desktop Window Manager has been a cornerstone of Windows since Vista. It’s the compositor that draws your windows, taskbar, and visual effects. The DWM Core Library, the piece that’s vulnerable here, handles the memory management for those surfaces. It’s not some obscure third-party driver; it’s deeply woven into the OS.

Information-disclosure bugs in graphics components aren’t new. Back in 2015, Microsoft patched a similar DWM memory leak (CVE-2015-2527) that also let local users read kernel memory. More recently, the Windows graphics stack has been a frequent target for researchers looking to break out of sandboxes or escalate privileges.

What makes CVE-2026-50437 notable, though, is its sheer simplicity. It doesn’t require timing tricks, race conditions, or tricking a user into opening a malicious document. An attacker just needs code execution on the machine—something they might already have from a phishing attack or a malicious download—and then they run their exploit. The DWM process, running as SYSTEM, dutifully hands over data it shouldn’t.

Microsoft has not released technical details about exactly which DWM function is vulnerable or how much memory can be read. That’s standard practice to prevent attackers from reverse-engineering the patch too quickly. But the advisory’s confirmation of the vulnerability class and impact means defenders should treat it as a credible, exploitable bug, not a theoretical one.

What you should do right now

The patch for CVE-2026-50437 is included in the July 14, 2026 cumulative updates for all affected Windows versions. There is no standalone download for this specific fix, and Microsoft has not published any workaround. You must install the full monthly rollup.

Here’s your action plan, tailored to your environment:

• For a single home PC or laptop: Open Windows Update (Settings > Windows Update), check for updates, and install everything that appears. After reboot, verify your OS build number by typing “winver” in the Start menu and confirming it matches or exceeds the patched build from the table above.
• For managed fleets: Deploy the July 2026 cumulative updates through your usual patch management pipeline—Windows Server Update Services, Microsoft Configuration Manager, Intune, or a third-party tool. Prioritize machines that host multiple users or sensitive data: RDS hosts, shared workstations, finance/HR computers, and developer workstations.
• For servers, including Server Core: Don’t skip these. Apply the update to all Windows Servers, regardless of whether they have a GUI. Server Core still includes the DWM core library. After patching, validate the build number with the [System.Environment]::OSVersion.Version PowerShell command.
• Don’t forget about legacy systems: Windows 10 21H2 and Windows 10 1809 are still in scope if they’re receiving ESU or LTSC updates. Check the build numbers carefully; if you’re on a long-term servicing branch, ensure you’re pulling the correct security-only or cumulative update.

A quick smoke test after deployment is wise. The cumulative update touches many system files, so verify that your key graphical applications, remote desktop sessions, and virtual desktop infrastructure still perform as expected. In rare cases, cumulative updates have caused rendering glitches with custom DWM themes or graphics drivers—but the risk of leaving the bug unpatched far outweighs any temporary hiccup.

The outlook: local attacks still pack a punch

CVE-2026-50437 won’t make headlines like a wormable remote-code-execution flaw, but it’s a reminder that the line between a minor local vulnerability and a major data breach is often thinner than it appears. In an era where attackers routinely drop multiple tools onto a compromised host, every information leak is a potential stepping stone.

Microsoft’s move to publish detailed build numbers for each affected version is a welcome aid for patch verification. We can expect more such transparency as the company continues to refine its security update guide. But for now, the message is clear: don’t let a low CVSS score lull you into complacency. Hit the update button, verify your build, and close this window before someone looks through it.