Microsoft Desktop Window Manager 0

Cybersecuritynews •Guru Baran • January 14, 2026

Microsoft patched a critical zero-day information disclosure flaw in its Desktop Window Manager (DWM) on January 13, 2026, in the Patch Tuesday update after detecting active exploitation in the wild. Tracked as CVE-2026-20805, the vulnerability allows low-privilege local attackers to expose sensitive user-mode memory, specifically section addresses, via remote ALPC ports. This could aid further […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Patches Critical DWM Vulnerabilities in January 2026 On January 13, 2026, Microsoft released a patch for a critical zero-day vulnerability in its Desktop Window Manager (DWM), tracked as CVE-2026-20805, which allowed local attackers to expose sensitive user-mode memory. Additionally, a separate out-of-bounds vulnerability, CVE-2025-55681, was identified, enabling local attackers to escalate privileges to SYSTEM on affected Windows systems, impacting Windows 10 and 11. 4 sources 38

Extracted Entities

Microsoft Desktop Window Manager 0

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)