CVE-2020-1067
HighCVSS 7.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A remote code execution vulnerability in Windows due to improper handling of objects in memory. An attacker with a domain user account could exploit it by creating a specially crafted request. The update corrects how Windows handles objects in memory.
Risk Assessment
Successful exploitation could allow an attacker to execute arbitrary code with elevated permissions on the target system, potentially leading to full system compromise.
Recommendation
Install the latest Windows security updates to mitigate this vulnerability.
Original NVD description (English source)
A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker who has a domain user account could create a specially crafted request, causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows handles objects in memory.