CVE-2020-1145
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Information disclosure vulnerability in Windows Graphics Device Interface (GDI) due to improper handling of objects in memory. An attacker can retrieve information from the system, but the disclosure alone does not allow arbitrary code execution.
Risk Assessment
Information disclosure could help an attacker in further attacks, especially when combined with another vulnerability, potentially leading to code execution.
Recommendation
Install the security update that corrects how GDI handles memory addresses.
Other vulnerabilities in Windows Graphics Device Interface (GDI)
See all- CVE-2020-1142High
Elevation of privilege vulnerability in the Windows Graphics Device Interface (GDI). An attacker who logs on can run a specially crafted application to execute arbitrary code in kernel mode, allowing installation of programs, data modification, or creation of accounts with full user rights.
- CVE-2020-1141Medium
Information disclosure vulnerability in Windows Graphics Device Interface (GDI) due to improper handling of objects in memory. An attacker can retrieve information from the system, but the disclosure alone does not allow arbitrary code execution.
Original NVD description (English source)
An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The security update addresses the vulnerability by correcting how GDI handles memory addresses.