Windows Desktop Window Manager flaw CVE-2026-20805 exploited before patching
Microsoft's January 2026 Windows updates fix CVE-2026-20805, a Desktop Window Manager memory-leak flaw already used in attacks. It needs local access. Install the latest Windows update on every PC, including older ones still covered by security updates.
Run Windows Update and install the latest cumulative update on every Windows 10 and 11 PC, then restart. If you manage family or office machines, confirm they are on a build at or above the fixed version.
- Windows 11 25H2fixed in 10.0.26200.7623 and later
- Windows 11 24H2fixed in 10.0.26100.7623 and later
- Windows 11 23H2fixed in 10.0.22631.6491 and later
- Windows 10 22H2fixed in 10.0.19045.6809 and later
- Windows 10 21H2fixed in 10.0.19044.6809 and later
- Windows 10 1809fixed in 10.0.17763.8276 and later
- Windows 10 1607fixed in 10.0.14393.8783 and later
What’s happening
On 13 January 2026 Microsoft fixed CVE-2026-20805, an information-disclosure flaw in the Desktop Window Manager, the part of Windows that draws windows on screen. An attacker who already has a foothold on a PC could use it to read a memory address belonging to a process, which should stay private. That kind of leak is typically useful for making other attacks work more reliably, though Microsoft has not said how attackers used it. Microsoft rated it Important, and CISA lists it as exploited in attacks (CVSS 5.5). Microsoft has not disclosed who the attackers or victims are, or the scale. The flaw is fixed in the January 2026 Patch Tuesday updates for supported Windows 10 and Windows 11 releases. BleepingComputer credits Microsoft's own threat intelligence teams with the discovery. As of early November 2026 we found no later fix, revision or change to the exploitation picture. Machines that never installed the January update or any later one remain exposed.
- What
- Flaw
- Affects
- Microsoft Windows 10 and Windows 11 (Desktop Window Manager)
- Affected
- Windows 10 Version 1607 below 10.0.14393.8783
Windows 10 Version 1809 below 10.0.17763.8276
Windows 10 Version 21H2 below 10.0.19044.6809
Windows 10 Version 22H2 below 10.0.19045.6809
Windows 11 Version 23H2 below 10.0.22631.6491
Windows 11 Version 24H2 below 10.0.26100.7623
Windows 11 Version 25H2 below 10.0.26200.7623 - Fixed in
- 10.0.14393.8783
10.0.17763.8276
10.0.19044.6809
10.0.19045.6809
10.0.22631.6491
10.0.26100.7623
10.0.26200.7623 - Since
- 13 Jan 2026
- Closed
- 13 Jan 2026
Timeline
- CISA added
CISA listed CVE-2026-20805 as exploited in attacks, with a CVSS score of 5.5. Microsoft has not said who the attackers or victims are, or how widely it was used.
- Made publicFixed
Microsoft fixed CVE-2026-20805, an information-disclosure flaw in Windows Desktop Window Manager, in its January 2026 Patch Tuesday updates and rated it Important and actively exploited. It was one of three zero-days fixed that month.
Sources
- CVE-2026-20805 Windows Information Disclosure VulnerabilityMicrosoft Security Response Center · 13 Jan 2026
- Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flawsBleepingComputer · 13 Jan 2026