CVE-2020-1021
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when it handles and executes files. An attacker could exploit it by running a specially crafted application to gain greater access to sensitive information and system functionality.
Risk Assessment
The risk for the organization is potential privilege escalation by a local attacker, which could lead to system compromise and access to sensitive data.
Recommendation
It is recommended to immediately apply the security update from the vendor that addresses the way WER handles and executes files.
Other vulnerabilities in Windows Error Reporting
See all- CVE-2026-20817High
Improper handling of insufficient permissions in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2021-24090High
Elevation of privilege vulnerability in Windows Error Reporting. Allows a local attacker to gain elevated privileges.
- CVE-2020-1088High
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when it handles and executes files. An attacker could exploit it by running a specially crafted application to gain greater access to sensitive information and system functionality.
- CVE-2020-1082High
Elevation of privilege vulnerability in Windows Error Reporting (WER) when WER handles and executes files. An attacker could gain greater access to sensitive information and system functionality.
Original NVD description (English source)
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.