CVE-2026-20805
Published Jan 13, 2026
Last updated 2 months ago
- Description
- Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_23h2, windows_11_24h2, windows_11_25h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025
CVSS 3.1
- Type
- Secondary
- Base score
- 5.5
- Impact score
- 3.6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
Data from CISA
- Vulnerability name
- Microsoft Windows Information Disclosure Vulnerability
- Exploit added on
- Jan 13, 2026
- Exploit action due
- Feb 3, 2026
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- secure@microsoft.com
- CWE-200
- Hype score
- Not currently trending
CVE-2025-21333/21334 + CVE-2026-20805: Hyper-V zero-days → SYSTEM access. DWM leaks memory to fuel exploit chains. 157 CVEs, 8 zero-days, one Patch Tuesday. CISA deadline expired today. Your critical servers run Hyper-V. Assume compromised if unpatched. Sweet dreams.
@CisoRaging77913
4 Feb 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2026-21509 2 - CVE-2026-20805 3 - CVE-2024-3094 4 - CVE-2024-1234 5 - CVE-2010-5139 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
3 Feb 2026
10 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Microsoft、Windowsの定例アップデートで3件のゼロデイ 脆弱性を修正(CVE-2026-20805/21265/CVE-2023-31096) https://t.co/pQkjWZas36 #セキュリティ対策Lab #セキュリティ #Security
@securityLab_jp
14 Jan 2026
221 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Microsoft January 2026 Patch Tuesday Fixes 115 Flaws, Including an Actively Exploited Zero-Day Microsoft’s January 2026 Patch Tuesday ships 115 fixes (8 Critical), including three zero-days: CVE-2026-20805 (DWM info leak) confirmed exploited in the wild, CVE-2023-31096 (Ag
@ThreatSynop
14 Jan 2026
80 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Microsoft patches critical Desktop Window Manager flaws, incl. zero-day CVE-2026-20805 and EoP CVE-2025-55681, letting local users read memory and gain SYSTEM on Windows 10-11. Apply Jan 13 updates. #Windows https://t.co/DsbDcq5TDM
@threatcluster
14 Jan 2026
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Microsoft January 2026 Patch Tuesday Fixes 114 Flaws, Including 3 Zero-Days Microsoft’s January 2026 Patch Tuesday addresses 114 vulnerabilities, including three zero-days (CVE-2026-20805 DWM info-disclosure, CVE-2026-21265 Windows Digital Media EoP, and CVE-2023-31096) wi
@ThreatSynop
14 Jan 2026
64 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "9A956D23-259E-450B-8406-FEB2BBED1F39",
"versionEndExcluding": "10.0.14393.8783",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "41D387B9-5E9D-47CB-B044-D7D10FFFB458",
"versionEndExcluding": "10.0.14393.8783",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "DD4CBDAB-7626-4048-8474-B1BD9C1F3255",
"versionEndExcluding": "10.0.17763.8276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "A6D4C631-2CC0-407C-9ACA-7C151006598C",
"versionEndExcluding": "10.0.17763.8276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1895E186-5B2E-43CC-AF1F-B5C95419D8C5",
"versionEndExcluding": "10.0.19044.6809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7CB5184-1BA1-4D71-8AE3-CF4C6B63A469",
"versionEndExcluding": "10.0.19045.6809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8D675DAA-4DCE-4727-BE5F-C954BBD252C4",
"versionEndExcluding": "10.0.22631.6491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D249551B-1433-4E5E-A587-40F782E91E09",
"versionEndExcluding": "10.0.26100.7623",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "22082D4E-E68F-4E48-98FB-42DFDEE2E2A8",
"versionEndExcluding": "10.0.26200.7623",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A059E609-F8D4-4246-BDAE-0AEDED1744D2",
"versionEndExcluding": "10.0.14393.8783",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A74970A1-CC81-4482-B465-8382B1544EF3",
"versionEndExcluding": "10.0.17763.8276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C4AA6991-DE34-48F6-AFD3-77CEE7FBB692",
"versionEndExcluding": "10.0.20348.4648",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BA5947E0-C44C-4517-A307-DA79752F30A8",
"versionEndExcluding": "10.0.25398.2092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6BE8CAC-3A47-48FC-A0FD-F0F0ADD2A9CE",
"versionEndExcluding": "10.0.26100.7623",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]