CVE-2026-20805

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to January 2026 Patch Tuesday

Description An information disclosure issue exists in Desktop Window Manager, potentially allowing an authorized attacker to disclose sensitive information locally. This issue is actively exploited in the wild and can leak sensitive memory details, potentially strengthening multi-stage attacks and making exploit chains more reliable. The vulnerability can be leveraged to leak memory addresses, which can aid in achieving code execution. The issue affects global Windows installations and is considered a zero-day.

Recommendations Apply the January 2026 Patch Tuesday updates to address this vulnerability.