uzair-baig0900/cve-2026-20805-pocThe PoC of information disclosure in Microsoft Desktop Windows Management.
Proof of Concept demonstrating an information disclosure vulnerability in Microsoft Desktop Window Manager (dwm.exe).
This repository contains a custom Proof of Concept (PoC) developed to reproduce CVE-2026-20805, an information disclosure vulnerability affecting the Windows Desktop Window Manager process. The vulnerability allows a local authenticated user to leak kernel object pointers due to improper handling of ALPC-related structures, potentially weakening kernel exploit mitigations such as Kernel Address Space Layout Randomization (KASLR). This PoC was implemented independently after identifying instability and execution issues in existing public scripts, with the objective of producing reliable and verifiable results.
dwm.exe)The PoC leverages low-level Windows Native APIs to enumerate system-wide handles and inspect kernel object metadata. It utilizes with the class to perform process-specific handle filtering and analyze ALPC Port and Section objects. Improperly initialized kernel object pointers are disclosed to user mode, confirming the information leakage.
NtQuerySystemInformationSystemHandleInformationObjects of Interest
During execution, the PoC successfully identified the dwm.exe process, enumerated hundreds of handles associated with Desktop Window Manager, and disclosed valid 64-bit kernel virtual addresses.
Author: UZAIR AMJAD-TEAM_ALKAHF
Sample Output
Handle: 0x0004
Object: 0xFFFFD58F80C0E5E0 (Kernel Object Pointer)
Handle: 0x011C
Object: 0xFFFFD58F80C0E1E0 (ALPC Section Address)
The leaked addresses fall within the expected kernel virtual address range, confirming successful information disclosure.