Zero-day in Windows DWM exploited in the wild prompts urgent patch

Microsoft patched a critical zero-day in Desktop Window Manager (DWM) after active exploitation in the wild. Tracked as CVE-2026-20805, the flaw allows low-privilege local attackers to leak user-mode memory addresses via remote ALPC ports, potentially aiding privilege escalation. Although not remotely exploitable, its low complexity and lack of user interaction make it attractive for malware or post-compromise operations. MSTIC and MSRC confirmed exploitation but noted no public proof-of-concept; patching, especially on legacy Windows versions in extended support, is urgently advised.