Eyewitnesses reported being woken by cries for help from inside the burning building, where children appeared trapped by metal window grills.
"I saw children kicking on the grill but they couldn't get out. My friends and I rushed over and tried to reach them but we couldn't get in," eyewitness Shahirman Shahril told CNN.
When emergency responders first arrived on the scene, "almost 90% of the building was already on fire," a Fire and Rescue department official told reporters.
Two adults also died in the the blaze, while four other victims suffered serious injuries.
"The firemen could hear cries for help from inside the building," spokesman Soiman Jahid said. "The first team from (the) fire station managed to save five of the children from the lower level."
Children tried to kick open grills on windows
Spokesman Jahid said firefighters found bodies in three different locations, all of them badly burned. A large number of victims found were piled on top of each other, while another was discovered in front of the main door.
"Based on my observation, the building has grills that could not be opened from inside," he said. "Because of the grills, they could not escape through the windows, except for the five students who escaped through the door and sought help from the firemen."
Later, Jahid told CNN one of the two fire exits had been blocked by renovations taking place on the second floor.
Identification of the victims could still take days, Health Minister Dr S Subramaniam told reporters at Kuala Lumpur General Hospital.
"The bodies suffered severe burns to the point that it is difficult to confirm the identities," he said.
Photos from the scene showed fire damage to the top floor of the three-story Darul Quran Ittifaqiyah Tahfiz school.
Norhayati Khalid was on her way to hospital to identify a body believed to be her son, 11-year-old Amin Ashraf. She said she last saw him just one day ago.
"I brought him some chicken floss buns (and) my son passed me a handwritten note to say he's happy here at the school and he wants to be a "hafiz" (someone who memorizes the Quran) so that he can take us to heaven," she told CNN.
"We moved him here three months ago from Kelantan and it's a popular school among the students and teachers. We didn't have to pay any school fees."
Investigators were examining whether a electric short circuit had caused the fire, but Deputy Inspector General of Police Noor Rashid Ibraham said a conclusion hadn't been reached yet.
He added the victims were all aged between 13 and 17, but when questioned about reports of even younger victims he said DNA testing would be required.
Ibraham said the building was new and had been used as a religious school specializing in Quranic studies.
School should not have been in operation
Malaysia's Minister of Urban Wellbeing, Housing and Local Government, Noh Omar, said there have been 29 similar incidents in the past involving fires at religious schools.
The school's license was being reviewed by the authorities and it should not have been in operation, Noh told reporters.
Six students and a member of the public were injured in the incident, Health Minister Subramaniam confirmed.
Malaysian Prime Minister Najib Razak expressed his sympathy for those affected on social media.
"Deeply saddened to hear Darul Quran Ittifaqiyah Tahfiz Center burned and that more than 20 lives were lost. May their souls be blessed by Allah SWT. Al Fatihah," he wrote on Twitter.
Malaysian media earlier reported that 25 people were killed, 23 students and two wardens.