CVE-2020-1021
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when it handles and executes files. An attacker could exploit it by running a specially crafted application to gain greater access to sensitive information and system functionality.
Risk Assessment
The risk for the organization is potential privilege escalation by a local attacker, which could lead to system compromise and access to sensitive data.
Recommendation
It is recommended to immediately apply the security update from the vendor that addresses the way WER handles and executes files.
Other vulnerabilities in Windows Error Reporting
See all- CVE-2026-97798High
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-85800High
A heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-85354High
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-83916High
Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
- CVE-2026-83840High
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-83826High
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- CVE-2026-83758High
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
- CVE-2026-83750High
Time-of-check time-of-use (TOCTOU) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally. The flaw stems from a race condition during resource checking and use.
- CVE-2026-83715High
Missing authentication for a critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
- CVE-2026-83689High
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS