CVE-2026-20805

This is a post-compromise information disclosure, not a traditional initial-access vulnerability. The 'authorized attacker' phrasing means the threat actor already has code execution or valid credentials—DWM is being leveraged as a reconnaissance and credential-harvesting tool within an established attack chain, not as a way in. DWM maintains GPU-resident composition surfaces for every window in the session. A medium-integrity attacker with SeDebugPrivilege can enumerate these surfaces through handle duplication rather than raw memory scraping—specifically by querying dwm.exe's desktop heap via NtQueryVirtualMemory and extracting GDI object handles that map to composition bitmaps. This is a design artifact of the GDI handle model layered onto modern session isolation, not a memory-corruption bug. For detection, prioritize Event ID 10 (ProcessAccess) in Sysmon where SourceImage is NOT dwm.exe but TargetImage IS dwm.exe, particularly when AccessMask contains 0x10 (VM_READ) or handle duplication patterns. Also monitor non-system processes performing bulk GDI bitmap extraction during logon sequences or credential prompts—the consumption phase creates higher-fidelity detection signals than the DWM access itself. Windows 10 1607 (the Anniversary Update, end-of-serviced since 2022) is the specific target. There will be no patch. For organizations still running this version in sensitive environments—regulated terminals, industrial HMIs, healthcare devices—the remediation path is detection engineering and compensating controls, not patching. Enable Restricted Admin mode for RDP, disable WDigest, and ensure Credential Guard is active where hardware supports it. The EPSS score of 0.05 for a KEV-listed vulnerability reflects the narrow window and small affected population—this is targeted post-exploitation, not mass-exploitable infrastructure. Prioritize detection logic over patching urgency.

Reviewed through automated stages and approved by a human before publication.