CVE-2026-20805
Microsoft Windows Information Disclosure Vulnerability
Description
CVE-2026-20805 is a medium-severity information disclosure vulnerability (CVSS 5.5) in the Desktop Window Manager (DWM) component of Microsoft Windows. The flaw allows an authorized local attacker to disclose sensitive information stored in memory, potentially exposing credentials, cryptographic keys, or other confidential data. It has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 3, 2026, and its EPSS score of 0.04146 (88.4th percentile) indicates significant exploitation probability. Ransomware association is currently unknown.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.8783 |
| microsoft | windows 10 1809 | < 10.0.17763.8276 |
| microsoft | windows 10 21h2 | < 10.0.19044.6809 |
| microsoft | windows 10 22h2 | < 10.0.19045.6809 |
| microsoft | windows 11 23h2 | < 10.0.22631.6491 |
| microsoft | windows 11 24h2 | < 10.0.26100.7623 |
| microsoft | windows 11 25h2 | < 10.0.26200.7623 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8783 |
| microsoft | windows server 2019 | < 10.0.17763.8276 |
| microsoft | windows server 2022 | < 10.0.20348.4648 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2092 |
| microsoft | windows server 2025 | < 10.0.26100.7623 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20805(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes situations where an application unintentionally reveals sensitive information to actors who are not explicitly authorized to access it. In CVE-2026-20805, the Windows Desktop Window Manager fails to properly protect memory regions, allowing an authenticated local user to read data that should be restricted. This type of information disclosure can serve as a stepping stone for privilege escalation, credential theft, or further exploitation of the compromised system.
Impact Analysis
The business impact of CVE-2026-20805 centers on the exposure of sensitive information from the Windows Desktop Window Manager process. Confidentiality is highly impacted, as an attacker with local access can read sensitive data from DWM memory, which may include user credentials, session tokens, or fragments of application data rendered through the compositing engine. Integrity and availability are not directly affected according to the CVSS metrics, but disclosed information could enable follow-on attacks such as privilege escalation or lateral movement. The EPSS score of 0.04146 (88.4th percentile) places this vulnerability in the top 12% of predicted exploitation activity, indicating that real-world exploitation is likely and may already be occurring. Combined with its KEV listing, organizations should treat this as an actively exploited threat. The vulnerability affects a broad range of Windows versions including Windows 10 (multiple builds), Windows 11 23H2 and 24H2, and Windows Server 2012, meaning the potential attack surface across enterprise environments is extensive. Although ransomware association is currently unknown, information disclosure vulnerabilities like this are frequently chained with other exploits in sophisticated attack campaigns.
Exploit Maturity
CVE-2026-20805 is confirmed as actively exploited and appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of February 3, 2026. The EPSS score of 0.04146 places it in the 88.4th percentile, which is significantly above average and indicates strong exploitation momentum. While no standalone public proof-of-concept has been tagged in the references, the KEV listing confirms that threat actors are actively leveraging this vulnerability in real-world attacks. Information disclosure vulnerabilities in Windows kernel-adjacent components like DWM are commonly used in exploit chains — attackers first leak memory to defeat ASLR or extract credentials, then leverage a separate privilege escalation or remote code execution vulnerability to gain full system control. The ransomware association is listed as unknown, but the broad Windows version coverage makes it a prime target for mass exploitation campaigns.
Remediation
- Install the latest Windows security updates — Apply the January 2026 cumulative security updates from Microsoft for all affected Windows versions. Refer to the Microsoft Security Response Center advisory for the specific KB articles corresponding to your OS build.
- Prioritize patching based on exposure — Systems with multiple local users, shared workstations, terminal servers, and Citrix/VDI environments should be patched first, as the vulnerability requires local authenticated access.
- Audit local user accounts and privileges — Review which accounts have local access to Windows systems and ensure that least-privilege principles are enforced, reducing the pool of potential attackers who could exploit this vulnerability.
- Enable and monitor Windows event logging — Configure advanced audit policies to capture unusual process behavior, memory access patterns, and suspicious DWM-related activity that could indicate exploitation attempts.
- Deploy endpoint detection and response (EDR) — Ensure EDR solutions are updated with signatures or behavioral rules that detect DWM memory disclosure exploitation techniques commonly used in post-compromise chains.
Technical Details
The CVSS v3.1 vector for CVE-2026-20805 is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, resulting in a base score of 5.5 (Medium). Attack Vector (Local) means the attacker must have local access to the target system — this is not remotely exploitable over the network. Attack Complexity (Low) indicates that exploitation is straightforward and does not require winning a race condition or gathering additional information. Privileges Required (Low) means the attacker needs a standard authenticated user account, not administrator-level access. User Interaction (None) confirms that no action from another user is required. Scope (Unchanged) indicates the vulnerability's impact does not extend beyond the affected component's security boundary. Confidentiality (High) reflects the attacker's ability to access all information within the DWM process memory. Integrity (None) and Availability (None) mean the attacker cannot modify data or disrupt service through this vulnerability alone. The Desktop Window Manager is a core Windows component responsible for visual composition of the desktop, managing window rendering, transparency, and visual effects. The vulnerability likely stems from an uninitialized memory or improper bounds-checking issue within DWM that allows a local process to read memory contents that should be isolated, potentially exposing sensitive data from other processes whose visual output is composited by DWM.
Frequently Asked Questions
What is the Desktop Window Manager in Windows?
The Desktop Window Manager (DWM) is a core Windows component that handles the visual composition of the desktop, including window rendering, transparency effects, and animations. Because it processes visual data from all running applications, a memory disclosure vulnerability in DWM can potentially expose sensitive information from other programs.
Can this vulnerability be exploited remotely?
No, CVE-2026-20805 requires local access to the target system with a valid user account. However, in enterprise environments with shared workstations, terminal servers, or compromised remote access, local vulnerabilities are routinely exploited by attackers who have already gained initial access.
Which Windows versions are affected?
The vulnerability affects a wide range of Windows versions including Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2012 including R2. Organizations should consult the Microsoft advisory for the complete list of affected builds and corresponding patches.
How is this vulnerability typically used in attacks?
Information disclosure vulnerabilities in Windows kernel-adjacent components are commonly used as part of exploit chains. Attackers first exploit the disclosure to leak memory addresses or sensitive data, then combine it with a separate privilege escalation exploit to gain full system control.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.