Microsoft Desktop Window Manager Zero

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Patches Critical DWM Vulnerabilities in January 2026 On January 13, 2026, Microsoft released a patch for a critical zero-day vulnerability in its Desktop Window Manager (DWM), tracked as CVE-2026-20805, which allowed local attackers to expose sensitive user-mode memory. Additionally, a separate out-of-bounds vulnerability, CVE-2025-55681, was identified, enabling local attackers to escalate privileges to SYSTEM on affected Windows systems, impacting Windows 10 and 11. 4 sources 38