What is the CVSS score of CVE-2026-20806?

CVE-2026-20806 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-20806?

Yes, a patch is available for CVE-2026-20806. Update the affected software to the latest version immediately.

Microsoft CVE-2026-20806

EUVD-2026-22351 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-14 microsoft

GHSA-mc2w-phmv-5vhg

Information Disclosure Memory Corruption Microsoft

5.5

CVSS 3.1 · NVD

Temporal: 4.8

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

4.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:42 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22351

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 5.5

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.

AnalysisAI

Type confusion in Windows COM component allows authenticated local attackers to read sensitive information from memory. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025 across multiple installation types. An attacker with local user privileges can exploit improper type handling in COM to disclose confidential data without modifying or disrupting system availability. Microsoft has released patches addressing this information disclosure risk.

Technical ContextAI

This vulnerability is rooted in CWE-843 (Type Confusion), a memory safety flaw in the Windows Component Object Model (COM) subsystem. COM is a Microsoft technology that enables inter-process communication and component reuse across Windows applications; it relies on strict type enforcement when marshalling objects between contexts. The flaw occurs when COM fails to properly validate or convert object types during resource access operations, causing the system to interpret memory regions as a different type than intended. This type confusion allows an attacker to read adjacent memory that would normally be inaccessible, bypassing access controls. The vulnerability requires local access (AV:L per CVSS vector) and authenticated user privileges (PR:L), limiting the attack surface to already-authenticated local accounts rather than remote attackers.

RemediationAI

Apply Microsoft security updates immediately to bring affected Windows editions above their respective patched build thresholds as documented in the MSRC advisory. For Windows 10 Version 1809, update to build 10.0.17763.8644 or later; for Windows 10 Version 21H2, update to build 10.0.19044.7184 or later; for Windows 10 Version 22H2, update to build 10.0.19045.7184 or later. For Windows 11, apply updates to reach: Version 22H3 build 10.0.22631.6936 or later, Version 23H2 build 10.0.22631.6936 or later, Version 24H2 build 10.0.26100.32690 or later, Version 25H2 build 10.0.26200.8246 or later, and Version 26H1 build 10.0.28000.1836 or later. For Windows Server 2019, update to build 10.0.17763.8644 or later; for Windows Server 2022, update to build 10.0.20348.5020 or later; and for Windows Server 2025, update to build 10.0.26100.32690 or later. Prioritize patching systems that process or store sensitive data. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20806 for deployment guidance and any applicable workarounds.