CVE-2020-1568
HighSummary
Istnieje podatność na zdalne wykonanie kodu, gdy czytnik PDF w Microsoft Edge niewłaściwie obsługuje obiekty w pamięci. Podatność ta może prowadzić do uszkodzenia pamięci, co umożliwia atakującemu wykonanie dowolnego kodu w kontekście aktualnego użytkownika.
Risk Assessment
Atakujący, który skutecznie wykorzysta tę podatność, może uzyskać takie same uprawnienia jak aktualny użytkownik. W przypadku, gdy użytkownik ma uprawnienia administracyjne, atakujący może przejąć kontrolę nad systemem.
Recommendation
Zaleca się aktualizację Microsoft Edge do najnowszej wersji oraz monitorowanie i blokowanie dostępu do podejrzanych stron internetowych, które mogą zawierać złośliwe treści PDF.
Related vulnerabilities
- CVE-2026-86102Critical
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
- CVE-2026-101894Critical
The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.
- CVE-2026-101891Critical
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
- CVE-2026-101081Critical
A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.
- CVE-2026-88804Critical
In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.
- CVE-2026-12342Critical
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
- CVE-2026-101077Critical
A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-101076Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101075Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101074Critical
A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that contains malicious PDF content. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted PDF content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-control
Vulnerability data from NVD (NIST) · CISA KEV · EPSS