CVE-2026-20826 Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in TWINUI Subsystem Affect Windows Users Two vulnerabilities have been identified in the Tablet Windows User Interface (TWINUI) Subsystem. CVE-2026-20826 allows authorized attackers to elevate privileges locally through a race condition, while CVE-2026-20827 enables the disclosure of sensitive information to unauthorized actors. Both vulnerabilities impact users of the TWINUI Subsystem. 2 sources 49

Extracted Entities

CVE-2026-20826 Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)

Vulnerabilities (1)