Windows Win32k CVE-2020-1054
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access (AV:L) as unprivileged user (PR:L) with high exploit complexity (AC:H) for kernel OOB write yielding full CIA compromise with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1143.
AnalysisAI
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to SYSTEM-level access by exploiting an out-of-bounds write triggered through the DrawIconEx API. Confirmed actively exploited (CISA KEV) with a publicly available proof-of-concept on Packet Storm, this flaw affects a sweeping range of Windows versions from Windows 7 through Windows 10 1909 and the full Windows Server ecosystem through 2019. The EPSS score of 52.78% at the 99th percentile aligns with documented real-world exploitation and places this well above typical local privilege escalation vulnerabilities in urgency.
Technical ContextAI
Win32k.sys is the kernel-mode graphics and window management subsystem in Windows, responsible for GDI rendering, window management, and user-space API calls including DrawIconEx. The root cause is classified as CWE-787 (Out-of-Bounds Write): the driver writes beyond an allocated memory buffer when improperly handling kernel objects, corrupting memory in a manner exploitable for privilege escalation. CPE strings confirm affected architectures include x86, x64, and ARM64 across Windows 10 versions 1507, 1607, 1709, and 1803. Tag metadata extends the affected surface to Windows 10 1809, 1903, and 1909; Windows 7; Windows 8.1; Windows RT 8.1; and Windows Server 2008, 2012, 2016, 2019, and semi-annual channel releases 1803, 1903, and 1909 - representing virtually the entire then-supported Windows estate at the time of disclosure.
RemediationAI
The primary and only reliable fix is applying Microsoft's May 2020 Patch Tuesday security update via Windows Update or the Microsoft Update Catalog; specific KB article numbers per affected Windows version and build are detailed at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1054 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1054. For systems that cannot be patched immediately, restricting interactive logon and remote desktop access to trusted, privileged accounts reduces the attack surface, since exploitation requires local code execution as a low-privileged user - but this is a mitigation, not a fix, and does not protect against insider threats or post-exploitation pivot scenarios. Disabling Win32k graphical subsystem functionality is not a viable compensating control given its central role in Windows operation. Given CISA KEV status, federal agencies are subject to Binding Operational Directive 22-01 remediation timelines; all organizations should treat patching as urgent.
More in Windows 10 1507
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperl
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today