Microsoft Patched Multiple Windows Information Disclosure Flaws Across Core Components

Microsoft published security advisories for several Windows information disclosure vulnerabilities affecting components including the COM Server, DWM Core Library, Windows Management Services, Windows Imaging Component, and DHCP Server Service. The issues were tracked as CVE-2026-20806, CVE-2025-33052, CVE-2025-59204, CVE-2025-53799, CVE-2025-21272, and CVE-2023-36012, showing a broad spread of disclosure risks across both client and server-side Windows functionality.

Among the disclosed flaws, Microsoft provided the most detail for CVE-2026-20806, describing it as a type confusion bug in the Windows COM Server that could let a local attacker with low privileges read sensitive data, including potentially User Mode Service Memory, without user interaction. Microsoft rated that issue Important with a CVSS 3.1 score of 5.5, said exploitation was considered unlikely, reported no public disclosure or observed exploitation at publication, and stated that an official fix was available; the remaining advisories were listed as information disclosure vulnerabilities with limited public technical detail.