cyber.hendryadrian.com
Threat Research · elastic.co

Elastic Details DirectComposition Use-After-Free Exploit in Windows DWM

· Original article ↗

Summary

Elastic Security Labs details a DirectComposition-triggered use-after-free in Windows DWM, the GetRECT heap spray and exploit chain, and a patch that forces resource removal to prevent the dangling pointer.

Key points

  • The article identifies a use-after-free in CSynchronousSuperWetInk::~CSynchronousSuperWetInk in dwmcore.dll, caused when a compatibility check skips removing the object from the manager.
  • It describes how a user-mode application can trigger the flaw through DirectComposition commands, leaving a dangling pointer that DWM later dereferences.
  • The GetRECT technique uses attacker-controlled CRegionGeometry RECT buffers to reclaim the freed allocation with controlled data.
  • The described exploit chain uses Windows callback and COM gadgets to make the spray memory executable and run inline shellcode.
  • The article reports successful code execution in DWM and says the researchers developed an alternative path to SYSTEM, but withhold details of that path.
  • The patch adds Feature_1732988217 to ensure RemoveSource() runs during destruction; the article identifies dwmcore.dll version 10.0.26100.7623 as fixed, versus 10.0.26100.7309 as vulnerable.
  • The author reports that newer LLMs shortened the time from vulnerability discovery to a functional exploit, while noting the resulting dual-use risk.

Article Details

Attack Vectors
  • A regular user-mode application uses D3D11/DXGI and DirectComposition to create an ink-trail resource, change LookupMode, and release it, leaving a dangling pointer that DWM later dereferences.
  • The GetRECT heap spray uses attacker-controlled CRegionGeometry RECT buffers sized to reclaim the freed allocation and supply a fake vtable.
  • The exploit chains the user32.dll __fnINSTRING handler with combase.dll CStdAsyncStubBuffer2_Disconnect to make the spray memory executable and run inline shellcode.
Defensive Notes
  • The article identifies dwmcore.dll version 10.0.26100.7623 as patched; the fix adds Feature_1732988217 to ensure RemoveSource() runs during destruction.
  • The author recommends defenders use AI-assisted offensive testing to find vulnerabilities and detection gaps in their code, security products, and enterprise environments.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe article reports that the exploit escalates from low-privilege user code to SYSTEM; it withholds details of the SYSTEM path.T1203 · Exploitation for Client ExecutionThe article describes exploiting the DWM use-after-free from a regular user-mode application through DirectComposition to achieve code execution in DWM.

People

Ruben BoonenThe article credits him, alongside Valentina Palmiotti, with previously demonstrating advanced Windows-target exploit development.Valentina PalmiottiThe article credits her, alongside Ruben Boonen, with previously demonstrating advanced Windows-target exploit development.

Vendors

MicrosoftNot to mention, many Microsoft-patched vulnerabilities come alongside new feature flags.

Products

Microsoft WindowsFor advanced Windows targets, Valentina Palmiotti and Ruben Boonen proved that this was already possible nearly 3 years ago.

Tools

BSimAfter training Ghidra on the files and extracting BSim vectors for every function, it becomes quite easy to highlight the differences between them.GhidraAfter training Ghidra on the files and extracting BSim vectors for every function, it becomes quite easy to highlight the differences between them.Opus 4.5The author notes LLM-assisted reverse engineering (Opus 4.5/4.6) dramatically reduced discovery-to-exploit time, highlighting dual-use risks and the need for defenders to adopt similar tooling.Opus 4.6path. However, with these techniques (and some other tooling) in hand and newer model releases like Opus 4.6, the time from discovering a UAF vulnerability in DWM to functional exploit dropped from 3 weeks to a

Related Articles