Product:
Desktop Windows Manager
Summary
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. This vulnerability can lead to significant confidentiality breaches. Attackers with low privileges can exploit this issue without requiring user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20805 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and be able to execute code. By leveraging the Desktop Windows Manager, the attacker can access sensitive information that should not be disclosed. This can be done by manipulating the system’s processes to extract confidential data.
Affected Products
- Desktop Windows Manager: Vulnerable to information disclosure due to improper handling of sensitive data.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, restricting local access to systems and monitoring for unauthorized access attempts can help reduce the risk of exploitation.