How to Fix CVE-2026-20805: Desktop Window Manager Information Disclosure in Windows

Patch this on your next emergency change window. CVE-2026-20805 sits in the Desktop Window Manager (DWM), a core graphics component that runs on every modern Windows desktop and server. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-13, federal civilian agencies had to remediate by 2026-02-03, and the fix already ships inside the monthly Windows cumulative update. There is no firewall rule and no winget package that closes it, the only durable fix is the Windows security update for your build.

What is CVE-2026-20805?

CVE-2026-20805 is an information-disclosure vulnerability in the Desktop Window Manager in Microsoft Windows. Microsoft's own record describes it plainly: "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally." It is classified as CWE-200 and carries a CVSS 3.1 base score of 5.5 (medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Read that vector carefully, because it changes how you should respond. AV:L means the attack is local, the attacker has to be able to run code on the box. PR:L means they need a valid, low-privileged account or process. C:H with I:N and A:N means the only impact is confidentiality: the flaw can leak sensitive in-memory data the DWM handles, but it does not let an attacker modify data or crash the machine. So this is not a remote-code-execution bug and it is not a denial-of-service bug. It is a memory-disclosure primitive that a local attacker uses to read things they should not see.

Why does a medium-severity local bug matter? Two reasons. First, DWM composites the screen for nearly every interactive Windows session, so the affected component is everywhere. Second, CISA put it on the KEV list, which means real attackers are already using it. In practice, leaked memory often contains pointers, handles, or session data that defeats address-space layout randomization and feeds the next stage of an attack chain. A small leak is the lever a larger compromise turns on.

Am I affected?

You are affected if your Windows OS build is below the fixed build for your version, as listed in the Fixed in row above. The flaw spans a wide range of supported Windows releases: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2012 through 2025. There is nothing to enumerate at the application level, DWM is part of the OS, so the OS build number is the answer.

Check your build with PowerShell. Do not use Win32_Product here; it enumerates installed MSI packages, not the operating system, and it is slow and side-effect-heavy. Read the build directly:

# Current OS build (major.minor.build.revision)
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR  # revision (the part after the last dot)

# Most reliable single readout of the full build string:
cmd /c ver

# Recently installed cumulative updates / KBs:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

Compare the CurrentBuild.UBR value (for example 26100.7600) against the fixed build for your version. If your revision number is lower than the fixed revision, you are vulnerable and need the latest cumulative update.

How to fix CVE-2026-20805

There is no standalone DWM download and no third-party package to upgrade. Microsoft fixed CVE-2026-20805 inside the monthly Windows cumulative security update for each supported version. Installing that update and rebooting is the fix. Pick the delivery channel that matches how you manage the machine.

Option A: Windows Update (single machine or small fleet)

On a workstation or a lightly managed server, install all pending security updates and reboot:

# Run PowerShell as Administrator

# Easiest interactive path:
# Settings > Windows Update > Check for updates > Install > Restart

# Scriptable scan, download, and install with the built-in Update agent:
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall

# Reboot once the install finishes so the patched DWM binaries load:
# Restart-Computer -Force

Option B: WSUS / Microsoft Configuration Manager (SCCM)

For a managed fleet, approve and deploy the relevant cumulative update through your patch system, then let the maintenance window run it:

1. Sync the latest Microsoft security updates in WSUS or Configuration Manager.
2. Approve the cumulative update for the affected Windows versions to the right collection or computer group.
3. Deploy with a deadline, then confirm the compliance report shows the new build.
4. Force a client-side check if you need it sooner: UsoClient StartScan on current agents, or wuauclt /detectnow /updatenow on older ones.

Option C: Microsoft Update Catalog (offline / air-gapped)

For isolated machines, download the exact cumulative update for your Windows version and architecture from the Microsoft Update Catalog and install the .msu directly:

# Install a cumulative update downloaded from the Update Catalog:
wusa.exe C:\Updates\windows10.0-kbXXXXXXX-x64.msu /quiet /norestart

# Reboot to load the patched binaries:
# Restart-Computer -Force

Legacy Server 2012 and Server 2012 R2 only receive this fix with active Extended Security Updates (ESU) coverage. If those servers are out of ESU they will not get the patched build and should be isolated or retired.

After applying the patch

1. Reboot. The patched DWM and graphics binaries only load after a restart, so an installed-but-not-rebooted machine is still vulnerable.
2. Re-read the OS build and confirm the revision is at or above the Fixed in value for your version.
3. Because this is a local information-disclosure flaw, review which low-privileged accounts and local apps can sign in to the affected host, and remove any that should not be there.

If you can't patch immediately

Microsoft lists no workaround and no mitigation for CVE-2026-20805 in its advisory: the update is the fix, and Desktop Window Manager cannot be disabled on a normal interactive desktop. Firewall rules do not help, because the attack is local, there is no network port to block. Until you can install the cumulative update, reduce the chance an attacker reaches a local session in the first place.

• Cut local access. Since exploitation needs a low-privileged local account (PR:L), remove unnecessary local and interactive logon rights and tighten who can sign in to the host. The fewer accounts that can run code locally, the fewer attackers can reach the flaw.
• Restrict interactive and RDP logon. Limit "Allow log on locally" and "Allow log on through Remote Desktop Services" to the admins who genuinely need it, via Group Policy. This shrinks the population that could trigger the disclosure.
• Block untrusted code execution. Application control (Windows Defender Application Control or AppLocker) stops a low-privileged user from launching the kind of unsigned local tool that would weaponize a memory-disclosure primitive.
• Watch for the precursor. Because this is a post-foothold primitive, prioritize detection of the initial access and unexpected local logons or processes on affected hosts.

These controls only lower the odds of local exploitation. They do not remove the flaw. Install the cumulative update at the first maintenance window.

How to verify the fix worked

Confirm the patched build is the one actually running, after the reboot.

# Read the full OS build (the number after the last dot is the revision/UBR)
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"{0}.{1}" -f $cv.CurrentBuild, $cv.UBR

# Or, in one line:
cmd /c ver

# Confirm the cumulative update KB is installed:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Expected: your build's revision is at or above the Fixed in value for your Windows version, for example 26100.7623 or higher on Windows 11 24H2 and Server 2025, 22631.6491 or higher on Windows 11 23H2, or 14393.8783 or higher on Windows 10 1607 and Server 2016. If the revision is still below that number, the cumulative update did not install or the machine has not rebooted.

Also worth doing: re-run an authenticated vulnerability scan with up-to-date signatures so your scanner stops flagging CVE-2026-20805 on the host, and check the MSRC advisory for the exact KB number tied to your build.

Can CVE-2026-20805 be exploited remotely over the network?

No. The CVSS vector is AV:L (local), so the attacker must already be able to run code on the machine, and PR:L means they need a valid low-privileged account. Desktop Window Manager runs in the interactive session, so this is a local information-disclosure flaw, not a remote one. Firewall rules and edge filters do not address it.

What does an attacker actually gain from CVE-2026-20805?

It is CWE-200, exposure of sensitive information to an unauthorized actor. A logged-in local user can read memory contents handled by Desktop Window Manager that they should not have access to. The vector shows C:H with I:N and A:N, so there is no integrity or availability impact, nothing is changed or taken down, but data can leak, often the kind that feeds a larger attack chain.

How do I patch CVE-2026-20805 on Windows?

There is no separate download for Desktop Window Manager. The fix ships inside the monthly Windows cumulative security update. Install the latest update through Windows Update, WSUS, Microsoft Configuration Manager (SCCM), or the Microsoft Update Catalog, then reboot, and confirm the OS build is at or above the fixed build for your Windows version.

Why patch a medium-severity flaw urgently?

The base score is 5.5 (medium), but CISA added CVE-2026-20805 to the Known Exploited Vulnerabilities catalog on 2026-01-13 with a remediation due date of 2026-02-03, and its SSVC analysis marks exploitation as active. KEV listing makes patching mandatory for U.S. federal agencies and a high priority for everyone else, regardless of the base score.

References

• Official vendor advisory: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-20805
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV entry: "Microsoft Windows Information Disclosure Vulnerability" - added 2026-01-13, due 2026-02-03
• Additional reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805

Assembled from the official vendor advisory, the NVD record, and the CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2026-40397: Critical Vulnerability in Windows 10 Version 1607
• How to Fix CVE-2026-21253: Use-After-Free in Windows 10 Version 1607
• How to Fix CVE-2026-32214: Cwe-284: improper access control in Microsoft Windows
• How to Fix CVE-2026-40413: Denial of Service in Windows 10 Version 1607
• How to Fix CVE-2026-20823: Information Disclosure in Windows 10 Version 1607