Microsoft DWM Core Library Elevation of Privilege Vulnerability

CVE-2025-30400 is an elevation of privilege vulnerability in Windows DWM (rated Important, CVSS 7.8). Microsoft reports that it is being exploited.

Exploited1 version

Microsoft id: CVE-2025-30400
Status: Exploited
Products: Windows DWM
Severity: Important
Impact: Elevation of Privilege
CVSS: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Exploited: Yes
Publicly disclosed: No
Exploitability: Exploitation Detected
Customer action required: Yes
Release: 2025-May
Assigned by: Microsoft
Weakness: CWE-416: Use After Free
MSRC revision: 1.0
First captured by us: 13 Nov 2026, 14:57 UTC (from our first import of this list)
Microsoft last modified: 13 May 2025, 07:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Security updates, 07:00 UTC, 13 May 2025

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 14:57 UTC, 13 Nov
As first seen: Exploited
Status
Exploited
Seen by us 14:57 UTC, 13 Nov · Microsoft's timestamp 07:00 UTC, 13 May 2025 · Microsoft's page