This article details a recently patched critical zero-day vulnerability (CVE-2026-20805) in Microsoft's Desktop Window Manager (DWM) that allows local low-privilege attackers to disclose sensitive memory addresses, aiding privilege escalation. The vulnerability is actively exploited in the wild and affects legacy Windows versions still under extended support. Microsoft has released patches and recommends urgent deployment alongside monitoring and restricting local low-privilege accounts.

The content provides timely, actionable threat intelligence on a critical zero-day vulnerability with detailed technical context, exploitation status, affected platforms, and mitigation guidance, making it highly relevant for defenders.

Defenders should prioritize applying the January 13, 2026 Patch Tuesday updates for affected Windows versions, restrict local low-privilege account access, and monitor DWM processes using EDR tools to detect potential exploitation attempts.