Patch Tuesday, January 2026 Edition

Patch Tuesday, January 2026 Edition reports that Microsoft today issued patches to fix at least 113 security holes across Windows and related software, eight of which were rated critical, with one zero-day, CVE-2026-20805, being actively exploited in the wild. According to Microsoft, the flaw lies in the Desktop Window Manager and has potential to be chained with other code-execution issues to defeat ASLR and enable practical attacks, prompting rapid patching as the main mitigation.

The edition also highlights two Microsoft Office remote code execution bugs, CVE-2026-20952 and CVE-2026-20953, which can be triggered by simply viewing a booby-trapped message in the Preview Pane. It notes attention to CVE-2026-21265, a critical Security Feature Bypass in Windows Secure Boot, whose associated root certificates are set to expire in June 2026 and October 2026, affecting devices lacking replacement certificates.

The piece references updates from Mozilla for Firefox and Firefox ESR (addressing CVE-2026-0891 and CVE-2026-0892) and cautions that Chrome WebView vulnerability CVE-2026-0628 was resolved in the January 6 Chrome update. It also mentions that security teams should monitor sources such as SANS Internet Storm Center and askwoody[.]com for patch guidance and potential issues during deployment.