Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager

CVE-2026-20805 is a local information disclosure flaw in Desktop Window Manager (DWM). Microsoft/NVD describe it as allowing an *authorized* attacker to disclose information locally, with Microsoft-adjacent reporting indicating the leak is a section address from a remote ALPC port in user-mode memory. Affected systems span broad Windows client and server families patched in the January 13, 2026 security updates, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Server 2016/2019/2022/2022 23H2/2025 below the fixed build cutoffs listed by NVD.

Microsoft's MEDIUM 5.5 base score is technically fair in isolation because this is local-only, low-privilege-required, confidentiality-only impact. Reality changes because CISA KEV says it was exploited in the wild on January 13, 2026, which means adversaries found operational value for it—most likely as a chain component that improves reliability of later privilege-escalation or sandbox-escape steps. That pushes it up one bucket for defenders, but not to CRITICAL, because it still needs a foothold first and does not by itself hand over code execution or SYSTEM.

Why this verdict

• Upgrade for KEV: CISA KEV means this moved from theoretical to operational on 2026-01-13.
• Downward pressure for attacker position: AV:L and PR:L mean the attacker already has code execution as a local user. That implies prior compromise, which narrows the reachable population compared with remote bugs.
• Downward pressure for impact shape: this is confidentiality-only and appears to leak memory-address information, not deliver code execution or privilege escalation by itself.
• Upward pressure for deployment breadth: DWM is everywhere in Windows fleets, so once an attacker is on-host, exposure is common across enterprise endpoints.
• Downward pressure for chain dependence: the bug becomes materially dangerous mostly when paired with another exploit or post-exploitation objective.

Why not higher?

This is not a front-door bug. An attacker must already be on the machine with at least low privileges, and the bug does not itself provide RCE, SYSTEM, or tenant-wide compromise. Even with KEV, that prerequisite chain keeps it below CRITICAL.

Why not lower?

Leaving this at MEDIUM would ignore the strongest real-world signal available: active exploitation confirmed strongly enough for KEV inclusion. In a 10,000-host estate, any bug already used in the wild across a ubiquitous component deserves faster handling than its base CVSS suggests.

1. Harden initial-access controls — Because this CVE is post-compromise, the best short-term risk reduction is to cut off the prerequisite foothold: tighten email/web filtering, ASR rules, application control, and macro/script execution. For a HIGH verdict, deploy or verify these controls within 30 days, but because this CVE is KEV-listed, treat it as patch / mitigate immediately, within hours for exposed high-value Windows populations.
2. Prioritize EDR containment on user-context implants — This bug matters most after a low-privileged implant lands. Tune EDR to isolate hosts showing suspicious user-context execution, exploit-chain behavior, or credential-theft precursors, and complete those detections and response playbooks within 30 days; for KEV-tracked risk, apply emergency tuning to high-risk segments within hours.
3. Accelerate patch deployment on workstation-heavy rings — DWM sits on the endpoint estate, so large workstation fleets are the practical exposure zone. Move January 2026 Windows cumulative updates to the front of your Windows patch queue and complete temporary risk-reduction measures within hours where active intrusion risk is highest.
4. Constrain lateral movement from user workstations — If attackers use this bug as a chain component after initial compromise, limiting where a user-context host can reach reduces payoff. Tighten admin share access, remote service creation, WinRM/RDP exposure, and privileged logon paths within 30 days, with emergency restrictions for sensitive segments within hours due to KEV status.

Run this on the target Windows host or through your endpoint management tool as PowerShell. Example: powershell -ExecutionPolicy Bypass -File .\Test-CVE-2026-20805.ps1. Standard user rights are usually enough because the script reads OS version data from the registry/CIM, but local admin is fine too.

# Test-CVE-2026-20805.ps1

# Checks Windows build/UBR against NVD-listed fixed build thresholds for CVE-2026-20805.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Get-OsInfo {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $os = Get-CimInstance Win32_OperatingSystem

    [pscustomobject]@{
        ProductName   = [string]$cv.ProductName
        DisplayVersion= [string]$cv.DisplayVersion
        ReleaseId     = [string]$cv.ReleaseId
        CurrentBuild  = [int]$cv.CurrentBuild
        UBR           = [int]$cv.UBR
        BuildLabEx    = [string]$cv.BuildLabEx
        Caption       = [string]$os.Caption
        Version       = [string]$os.Version
    }
}

function Get-Threshold {
    param([object]$info)

    $build = $info.CurrentBuild
    $ubr   = $info.UBR
    $name  = ($info.ProductName + ' ' + $info.Caption).ToLowerInvariant()
    $dv    = [string]$info.DisplayVersion

    # NVD fixed build thresholds observed for CVE-2026-20805

    # 14393.8783  -> Win10 1607 / Server 2016

    # 17763.8276  -> Win10 1809 / Server 2019

    # 19044.6809  -> Win10 21H2

    # 19045.6809  -> Win10 22H2

    # 20348.4648  -> Server 2022

    # 22631.6491  -> Win11 23H2

    # 25398.2092  -> Server 2022 23H2

    # 26100.7623  -> Win11 24H2 / Server 2025

    # 26200.7623  -> Win11 25H2


    switch ($build) {
        14393 { return 8783 }
        17763 { return 8276 }
        19044 { return 6809 }
        19045 { return 6809 }
        20348 { return 4648 }
        22631 { return 6491 }
        25398 { return 2092 }
        26100 { return 7623 }
        26200 { return 7623 }
        default {
            if ($name -match 'server 2012') {
                return $null
            }
            return $null
        }
    }
}

try {
    $info = Get-OsInfo
    $threshold = Get-Threshold -info $info

    Write-Output ("ProductName: {0}" -f $info.ProductName)
    Write-Output ("Caption: {0}" -f $info.Caption)
    Write-Output ("DisplayVersion: {0}" -f $info.DisplayVersion)
    Write-Output ("Version: {0}" -f $info.Version)
    Write-Output ("Build: {0}.{1}" -f $info.CurrentBuild, $info.UBR)

    if ($null -eq $threshold) {
        Write-Output 'UNKNOWN'
        Write-Output 'Reason: This script has no authoritative fixed-build threshold for this OS branch in the embedded map.'
        exit 2
    }

    if ($info.UBR -lt $threshold) {
        Write-Output 'VULNERABLE'
        Write-Output ("Reason: Build {0}.{1} is below fixed threshold {0}.{2} for CVE-2026-20805." -f $info.CurrentBuild, $info.UBR, $threshold)
        exit 1
    }
    else {
        Write-Output 'PATCHED'
        Write-Output ("Reason: Build {0}.{1} meets or exceeds fixed threshold {0}.{2} for CVE-2026-20805." -f $info.CurrentBuild, $info.UBR, $threshold)
        exit 0
    }
}
catch {
    Write-Output 'UNKNOWN'
    Write-Output ("Reason: Error while collecting OS version data: {0}" -f $_.Exception.Message)
    exit 3
}

Sources

1. Microsoft Security Update Guide entry
2. NVD CVE record
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview/API documentation
5. Cisco Talos January 2026 Patch Tuesday analysis
6. Tenable January 2026 Patch Tuesday analysis
7. CVE.org record
8. Wiz CVE page with EPSS percentile display