Description
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 – < 10.0.14393.8783 | 10.0.14393.8783 |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 – < 10.0.17763.8276 | 10.0.17763.8276 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 – < 10.0.19044.6809 | 10.0.19044.6809 |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 – < 10.0.19045.6809 | 10.0.19045.6809 |
| Microsoft | Windows 11 version 23H2 | 10.0.22631.0 – < 10.0.22631.6491 | 10.0.22631.6491 |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 – < 10.0.26100.7623 | 10.0.26100.7623 |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 – < 10.0.26200.7623 | 10.0.26200.7623 |
| Microsoft | Windows Server 2012 | 6.2.9200.0 – < 6.2.9200.25868 | 6.2.9200.25868 |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 – < 6.2.9200.25868 | 6.2.9200.25868 |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 – < 6.3.9600.22968 | 6.3.9600.22968 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 – < 6.3.9600.22968 | 6.3.9600.22968 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 – < 10.0.14393.8783 | 10.0.14393.8783 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 – < 10.0.14393.8783 | 10.0.14393.8783 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 – < 10.0.17763.8276 | 10.0.17763.8276 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 – < 10.0.17763.8276 | 10.0.17763.8276 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 – < 10.0.20348.4648 | 10.0.20348.4648 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 – < 10.0.25398.2092 | 10.0.25398.2092 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 – < 10.0.26100.32230 | 10.0.26100.32230 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 – < 10.0.26100.32230 | 10.0.26100.32230 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
fevar54/CVE-2026-20805-POC ★ 7 · Jan 14, 2026
PoC de CVE-2026-20805: divulgacion de informacion en Desktop Window Manager (dwm.exe) de Windows.
-
Uzair-Baig0900/CVE-2026-20805-PoC ★ 2 · Jan 19, 2026
The PoC of information disclosure in Microsoft Desktop Windows Management.
-
SimoesCTT/-SCTT-2026-33-0002-DWM-Visual-Field-Singularity ★ 1 · Jan 31, 2026
### 📡 Theoretical Classification **ID:** SCTT-2026-33-0002 **Researcher:** Americo Simoes (SimoesCTT) **Physics:** Theorem 4.2 - Turbulent Phase Transition (TPT) **Constant:** α = 0.0302011 **Target:…
-
SimoesCTT/SCTT-2026-33-0002-DWM-Visual-Field-Singularity ★ 0 · Jan 31, 2026
Microsoft just patched CVE-2026-20805 and CVE-2026-20871 in January 2026 to stop "Information Disclosure" and "Use-After-Free" bugs in DWM. They think they've secured the "Visual Boundary." We are ab…
-
mrk336/Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data ★ 0 · Jan 28, 2026
CVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Rated CVSS 5.5 (Medium). Actively exploited and listed in CIS…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- NCSC-2026-0007 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Apr 10, 2026
- WID-SEC-2026-0083 Microsoft Windows : Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2026
- MSRC-CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability Microsoft Security Response Center · Jan 27, 2026
References
- Desktop Window Manager Information Disclosure Vulnerability vendor-advisory patch