What is the CVSS score of CVE-2020-1061?

CVE-2020-1061 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 10.6%.

Which versions of Microsoft Script Runtime are affected by CVE-2020-1061?

Microsoft Script Runtime remote code execution vulnerability (CVE-2020-1061) affects Windows 7 through Windows 10 and Windows Server systems, allowing unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2020-1061?

Within 24 hours, conduct a complete inventory of all Windows 7 SP1, Windows 10 (versions through 1909), and Windows Server systems in your environment and provision the Microsoft security patch in a controlled test environment to verify compatibility. Within 7 days, validate the patch on non-production systems, then initiate staged deployment to production with priority given to internet-facing workstations and systems handling sensitive data. Within 30 days, achieve 95% or greater patch coverage across all affected Windows systems, deploy endpoint detection tuning to identify Script Runtime exploitation attempts, and perform patch compliance validation through vulnerability scanning.

Microsoft Script Runtime CVE-2020-1061

HIGH

Out-of-bounds Write (CWE-787)

2020-05-21 secure@microsoft.com

RCE Buffer Overflow Memory Corruption Microsoft Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows 10 Windows 7 Windows 8 1 Windows Rt 8 1

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network delivery with no auth required (PR:N), but AC:H for heap state preconditions and UI:R for mandatory user interaction; full C/I/A impact reflects arbitrary code execution potential.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 17:49 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 19, 2026 - 17:48 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Aug 19, 2026 - 17:22 NVD

8.8 (HIGH) 7.5 (HIGH)

CVE Published

May 21, 2020 - 23:15 nvd

HIGH 8.8

DescriptionNVD

A remote code execution vulnerability exists in the way that the Microsoft Script Runtime handles objects in memory, aka 'Microsoft Script Runtime Remote Code Execution Vulnerability'.

AnalysisAI

Remote code execution in the Microsoft Script Runtime affects Windows 7 SP1 through Windows 10 1909 and multiple Windows Server editions, stemming from improper handling of objects in memory (CWE-787: Out-of-bounds Write). An unauthenticated remote attacker can exploit this by convincing a user to visit a malicious webpage or open a crafted file that causes the Script Runtime to corrupt memory, ultimately executing arbitrary code in the context of the victim user. No confirmed active exploitation (not in CISA KEV) and no public POC are identified in available data, but an EPSS score of 10.62% at the 95th percentile signals materially elevated real-world exploitation probability compared to most vulnerabilities.

Technical ContextAI

The Microsoft Script Runtime (commonly manifested as scrrun.dll or scripting engines such as VBScript/JScript) is a Windows component responsible for executing scripts invoked via Internet Explorer, Windows Script Host (WSH), HTML Applications (HTA), and Office macros. CWE-787 (Out-of-bounds Write) identifies the root cause as a memory corruption flaw - the runtime writes data beyond the bounds of an allocated buffer when processing specially crafted script objects, potentially overwriting adjacent memory structures in a way that redirects execution flow. CPE data confirms affected client systems: cpe:2.3:o:microsoft:windows_10 across base and versions 1607 through 1909, cpe:2.3:o:microsoft:windows_7:-:sp1, cpe:2.3:o:microsoft:windows_8.1, and cpe:2.3:o:microsoft:windows_rt_8.1. Tags additionally implicate Windows Server 2008, 2012, 2016, and 2019, though these are not reflected in the provided CPE strings and should be verified against the Microsoft advisory.

RemediationAI

Microsoft has released a patch addressing this vulnerability, available through Windows Update, Windows Server Update Services (WSUS), and the Microsoft Update Catalog. Organizations should apply the relevant Patch Tuesday cumulative update for their Windows version immediately, referencing the MSRC advisory at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1061 for specific KB article numbers per OS version. An exact patched version number was not independently confirmed from the available data beyond 'patch available per vendor advisory.' As a compensating control prior to patching, administrators can restrict or disable scripting engines in Internet Explorer via Group Policy (disabling Active Scripting under Internet Zone settings), which reduces the primary browser-based attack surface; note this may break legitimate web applications that rely on client-side scripting and should be tested. On server systems, enabling Internet Explorer Enhanced Security Configuration (IE ESC) narrows the attack surface with less functional disruption than fully disabling scripting.