Windows TLS CVE-2020-1118
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-exposed TLS with no auth, scope change consistent with kernel-mode crash affecting the broader host; pure availability impact only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges, aka 'Microsoft Windows Transport Layer Security Denial of Service Vulnerability'.
AnalysisAI
Denial of service in the Windows Transport Layer Security (TLS) stack allows remote unauthenticated attackers to crash affected systems by sending malformed key exchange messages, with a Changed scope indicating the crash can propagate beyond the TLS component itself. Affected platforms span Windows 10 versions 1709 through 1909 and Windows Server 2019, making the exposure surface extremely broad. No public exploit code or CISA KEV listing is confirmed at time of analysis, though an EPSS score of 16.13% at the 97th percentile signals elevated exploitation interest relative to the broader CVE population.
Technical ContextAI
The vulnerability resides in the Windows operating system's native TLS implementation - the stack responsible for negotiating secure connections across virtually all TLS-dependent Windows services, including IIS, RDP, LDAPS, and WinRM. During the TLS handshake, the affected code improperly handles certain key exchange messages, triggering a fault condition. The CPE data confirms affected builds are Windows 10 (versions 1709, 1803, 1809, 1903, 1909) and Windows Server 2019 (base release, 1903, 1909 semi-annual channel). No CWE classification is provided in the source data; the root cause class is unspecified but consistent with memory safety or state machine handling errors common in TLS parser vulnerabilities. The Changed scope (S:C) in the CVSS vector suggests the fault can escape the TLS process boundary and impact the broader system - consistent with a kernel-mode TLS component crash.
RemediationAI
Apply the Microsoft security update released for this vulnerability, available through Windows Update, WSUS, and Microsoft Update Catalog, referenced at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1118. An exact patched build version is not specified in the available input data beyond 'patch available from vendor' - consult the MSRC advisory directly to identify the specific KB article for each affected Windows 10 and Server 2019 build. As a compensating control where immediate patching is not feasible, restrict inbound TLS traffic to trusted IP ranges at the network perimeter to reduce exposure of vulnerable endpoints - note this does not eliminate risk for internal east-west TLS traffic. Disabling non-essential TLS-facing services (e.g., LDAPS on DCs not requiring it) can further reduce attack surface, though this may impact authentication workflows. Prioritize Server 2019 endpoints exposed to untrusted networks first, as these represent the highest-risk intersection of exposure and impact.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today