CVE-2026-20805

MediumPublished

Desktop Window Manager Information Disclosure Vulnerability

Published: Jan 13, 2026
Updated: Jul 30, 2026
Assigning CNA: microsoft
Evidence observed: Jan 13, 2026

Primary CVSS

5.5/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

5.2%

Low · next 30 days

Percentile: 92.1%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

Sources

CVE-2026-20805-POCPoC
PoC de CVE-2026-20805: divulgacion de informacion en Desktop Window Manager (dwm.exe) de Windows.
Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-DataPoC
CVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Rated CVSS 5.5 (Medium). Actively exploited and listed in CISA KEV; patch released January 2026.
CVE-2026-20805-PoCPoC
Proof-of-concept exploit code for CVE-2026-20805, demonstrating the vulnerability for security research and validation.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.