CVE-2026-20827 Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to disclose information locally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in TWINUI Subsystem Affect Windows Users Two vulnerabilities have been identified in the Tablet Windows User Interface (TWINUI) Subsystem. CVE-2026-20826 allows authorized attackers to elevate privileges locally through a race condition, while CVE-2026-20827 enables the disclosure of sensitive information to unauthorized actors. Both vulnerabilities impact users of the TWINUI Subsystem. 2 sources 49

Extracted Entities

CVE-2026-20827 Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)