好的，我现在要帮用户总结这篇文章的内容。用户的要求是用中文总结，控制在100个字以内，而且不需要以“文章内容总结”或“这篇文章”这样的开头，直接写描述即可。 首先，我需要通读整篇文章，抓住主要信息。文章讲的是美国政府机构被要求修补一个影响微软桌面窗口管理器的漏洞。这个漏洞已经被恶意行为者利用了。CISA已经将这个漏洞加入到已知被利用的漏洞目录中。微软在2026年的第一次补丁星期二活动中披露了这个漏洞，总共有113个漏洞。联邦 civilian 机构有到2月3日的时间来修补这个漏洞。 接下来，DWM的作用是管理桌面的视觉效果和其他功能，是一个关键组件。专家提到这个漏洞的严重性评分是5.5/10，属于中低级，但会导致信息泄露。攻击者可以利用它破坏ASLR，进而结合其他代码执行漏洞进行攻击。微软没有披露更多细节，这限制了防御者的能力。 另外，Tenable的Satnam Narang指出，利用这个漏洞需要本地访问权限。DWM自2022年以来已经被修补过20次CVE，但这是第一次在野利用的信息泄露漏洞。Automox的Ryan Braunstein提到DWM以提升权限运行，攻击者不需要管理员权限就能利用它。 最后，CISA在2026年还添加了其他三个已知被利用的漏洞。 现在我需要把这些信息浓缩到100字以内。重点包括：美国政府机构修补微软DWM漏洞；该漏洞已被利用；CISA加入目录；影响系统安全；需尽快修复。 可能的结构：美国政府机构被要求修补影响微软桌面窗口管理器的漏洞 CVE-2026-20805，该漏洞已被恶意行为者利用。CISA已将其加入已知被利用的漏洞目录中，并要求联邦 civilian 机构在2月3日前完成修补。该漏洞可能导致信息泄露，并影响系统安全机制ASLR，需及时修复以防范潜在攻击。 </think> 美国政府机构被要求修补影响微软桌面窗口管理器的漏洞 CVE-2026-20805，该漏洞已被恶意行为者利用。CISA已将其加入已知被利用的漏洞目录中，并要求联邦 civilian 机构在2月3日前完成修补。该漏洞可能导致信息泄露，并影响系统安全机制ASLR，需及时修复以防范潜在攻击。 2026-1-14 13:46:12 Author: therecord.media(查看原文) 阅读量:1 收藏
U.S. government agencies have been ordered to patch a vulnerability impacting Microsoft’s Desktop Windows Manager after it was confirmed the bug has been exploited by threat actors. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability, tracked as CVE-2026-20805, to its exploited bugs catalog on Tuesday. It was one of 113 vulnerabilities disclosed by Microsoft as part of the first Patch Tuesday batch of 2026. Federal civilian agencies will have until February 3 to patch the vulnerability. The Desktop Windows Manager (DWM) enables visual effects on a Microsoft desktop as well as various other features. It is a key part of how windows appear on a user’s screen. Kev Breen, senior director of cyberthreat research at Immersive, said that while the bug’s severity score of 5.5 out of 10 is low, the flaw does lead to the leakage of information. “Vulnerabilities of this nature are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits,” he explained. “By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack.” He noted that Microsoft did not disclose what additional components may be involved in the exploit chain, “significantly limiting defenders’ ability to proactively threat hunt for related activity.” Tenable’s Satnam Narang added that exploitation of CVE-2026-20805 requires the attacker to have local access to the targeted system. Narang told Recorded Future News that DWM is a “frequent flyer” on Patch Tuesday — with 20 CVEs patched since 2022. But this is the first time there has been an information disclosure bug in this component exploited in the wild. The DWM process runs with elevated privileges because it needs them to do its job, according to Automox’s Ryan Braunstein, meaning attackers will not need administrative privileges to exploit it. Braunstein said attackers will likely leverage any application capable of drawing windows to trigger the vulnerability before using the information disclosure to gather data for further attacks. CISA has added three other bugs to the Known Exploited Vulnerabilities catalog in 2026.
Get more insights with the
Recorded Future
Intelligence Cloud.
如有侵权请联系:admin#unsafe.sh