Microsoft Windows
CVE-2020-1067
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector and required user interaction align with file-based delivery; no privileges needed; full C/I/A impact is consistent with arbitrary code execution.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.
AnalysisAI
Remote code execution in Microsoft Windows' memory object handling allows an attacker who delivers a specially crafted file to gain full system control upon user interaction. Affected platforms span Windows 7 SP1 through all Windows 10 release channels up to 1909, as well as Windows 8.1, RT 8.1, and multiple Windows Server generations per tag data. No public exploit has been identified at time of analysis, but the EPSS score of 9.46% at the 95th percentile is a strong outlier signal indicating elevated exploitation probability relative to the broader CVE population.
Technical ContextAI
The vulnerability resides in the Windows operating system's handling of objects in memory - a deliberately generic description by Microsoft that typically points to a kernel or user-mode component mishandling structured data such as a file format parser, GDI object, or shell component. No CWE classification was assigned, obscuring the precise root cause, but the CVSS vector (AV:L/AC:L/PR:N/UI:R) strongly suggests the trigger is a user opening or rendering a maliciously crafted file or object. Affected CPEs cover the full Windows 10 build tree from baseline through 1909, plus Windows 7 SP1 and Windows 8.1/RT 8.1, indicating a broadly shared code path across the Windows NT kernel family. Server variants (Windows Server 2008, 2012, 2016, and 2019) are listed in the advisory tags, extending exposure to server workloads running desktop-class components such as the shell or graphics subsystem.
RemediationAI
Apply the Microsoft security update available through Windows Update or the Microsoft Update Catalog as referenced in the MSRC advisory at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1067; the specific KB article and cumulative update number for each affected Windows build must be retrieved directly from the advisory, as an exact patched version number was not independently confirmed from the available data. For organizations unable to patch immediately, restrict user exposure to untrusted files from external sources using AppLocker or Windows Defender Application Control (WDAC) policies that limit which file types can be opened or rendered - note this reduces but does not eliminate risk, as trusted-looking files delivered via email or web download may still reach users. Organizations still running Windows 7 SP1 should be aware that mainstream extended support ended in January 2020; receiving this and future fixes requires enrollment in Microsoft's Extended Security Updates (ESU) program, and the long-term remediation is migration to a supported Windows version.
More in Windows Server 2008
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Win32k.sys in Windows Server 2003, Vista, and Server 2008 allows local privilege escalation through a kernel-mode vulner
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Share
External POC / Exploit Code
Leaving vuln.today