{"id":"windows-dwm-info-disclosure-exploited-jan-2026","category":"patch","status":"closed","title":"Windows Desktop Window Manager flaw CVE-2026-20805 exploited before patching","tldr":"Microsoft's January 2026 Windows updates fix CVE-2026-20805, a Desktop Window Manager memory-leak flaw already used in attacks. It needs local access. Install the latest Windows update on every PC, including older ones still covered by security updates.","summary":"On 13 January 2026 Microsoft fixed CVE-2026-20805, an information-disclosure flaw in the Desktop Window Manager, the part of Windows that draws windows on screen. An attacker who already has a foothold on a PC could use it to read a memory address belonging to a process, which should stay private. That kind of leak is typically useful for making other attacks work more reliably, though Microsoft has not said how attackers used it. Microsoft rated it Important, and CISA lists it as exploited in attacks (CVSS 5.5). Microsoft has not disclosed who the attackers or victims are, or the scale. The flaw is fixed in the January 2026 Patch Tuesday updates for supported Windows 10 and Windows 11 releases. BleepingComputer credits Microsoft's own threat intelligence teams with the discovery. As of early November 2026 we found no later fix, revision or change to the exploitation picture. Machines that never installed the January update or any later one remain exposed.","action":"Run Windows Update and install the latest cumulative update on every Windows 10 and 11 PC, then restart. If you manage family or office machines, confirm they are on a build at or above the fixed version.","product":"Microsoft Windows 10 and Windows 11 (Desktop Window Manager)","audience":"both","severity":"medium","patch":"patched","exploited":true,"cves":["CVE-2026-20805"],"tags":["microsoft","windows","windows-11","windows-10","zero-day","dwm","information-disclosure","patch-tuesday"],"affected":["Windows 10 Version 1607 below 10.0.14393.8783","Windows 10 Version 1809 below 10.0.17763.8276","Windows 10 Version 21H2 below 10.0.19044.6809","Windows 10 Version 22H2 below 10.0.19045.6809","Windows 11 Version 23H2 below 10.0.22631.6491","Windows 11 Version 24H2 below 10.0.26100.7623","Windows 11 Version 25H2 below 10.0.26200.7623"],"fixed":["10.0.14393.8783","10.0.17763.8276","10.0.19044.6809","10.0.19045.6809","10.0.22631.6491","10.0.26100.7623","10.0.26200.7623"],"matches":[{"platform":"windows","app":"Windows 11 25H2","bundle":"","fixed":"10.0.26200.7623"},{"platform":"windows","app":"Windows 11 24H2","bundle":"","fixed":"10.0.26100.7623"},{"platform":"windows","app":"Windows 11 23H2","bundle":"","fixed":"10.0.22631.6491"},{"platform":"windows","app":"Windows 10 22H2","bundle":"","fixed":"10.0.19045.6809"},{"platform":"windows","app":"Windows 10 21H2","bundle":"","fixed":"10.0.19044.6809"},{"platform":"windows","app":"Windows 10 1809","bundle":"","fixed":"10.0.17763.8276"},{"platform":"windows","app":"Windows 10 1607","bundle":"","fixed":"10.0.14393.8783"}],"sources":[{"kind":"advisory","title":"CVE-2026-20805 Windows Information Disclosure Vulnerability","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805","by":"Microsoft Security Response Center","date":"2026-01-13"},{"kind":"news","title":"Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2026-patch-tuesday-fixes-3-zero-days-114-flaws/amp/","by":"BleepingComputer","date":"2026-01-13"}],"started":"2026-01-13","closed":"2026-01-13","created":"2026-11-03T21:35:51.812Z","updated":"2026-11-03T21:35:51.812Z","cve_notes":[{"cve":"CVE-2026-20805","name":"Information disclosure in Windows Desktop Window Manager","what":"A flaw in the Desktop Window Manager, the part of Windows that draws windows on screen, that lets someone with local access read a memory address from another process, which can help make other attacks more reliable.","severity":"medium","cvss":5.5}],"timeline":[{"at":"2026-01-13","added":"2026-11-03T21:32:34.430Z","kind":"cisa-added","text":"CISA listed CVE-2026-20805 as exploited in attacks, with a CVSS score of 5.5. Microsoft has not said who the attackers or victims are, or how widely it was used.","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805","by":"Microsoft Security Response Center","patch":null},{"at":"2026-01-13","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Microsoft fixed CVE-2026-20805, an information-disclosure flaw in Windows Desktop Window Manager, in its January 2026 Patch Tuesday updates and rated it Important and actively exploited. It was one of three zero-days fixed that month.","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2026-patch-tuesday-fixes-3-zero-days-114-flaws/amp/","by":"BleepingComputer","patch":"patched"}],"url":"https://hard.fyi/live/windows-dwm-info-disclosure-exploited-jan-2026/","json":"https://hard.fyi/api/live?id=windows-dwm-info-disclosure-exploited-jan-2026"}