CVE-2020-1142
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Elevation of privilege vulnerability in the Windows Graphics Device Interface (GDI). An attacker who logs on can run a specially crafted application to execute arbitrary code in kernel mode, allowing installation of programs, data modification, or creation of accounts with full user rights.
Risk Assessment
Full system compromise by a local user.
Recommendation
Install the security update that corrects how GDI handles objects in memory and prevents unintended user-mode privilege elevation.
Other vulnerabilities in Windows Graphics Device Interface (GDI)
See all- CVE-2020-1145Medium
Information disclosure vulnerability in Windows Graphics Device Interface (GDI) due to improper handling of objects in memory. An attacker can retrieve information from the system, but the disclosure alone does not allow arbitrary code execution.
- CVE-2020-1141Medium
Information disclosure vulnerability in Windows Graphics Device Interface (GDI) due to improper handling of objects in memory. An attacker can retrieve information from the system, but the disclosure alone does not allow arbitrary code execution.
Original NVD description (English source)
An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses the vulnerability by correcting how GDI handles objects in memory and by preventing instances of unintended user-mode privilege elevation.