Windows Clipboard Service CVE-2020-1121
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege requirement and high complexity fits a race-condition flaw in a privileged service; full C/I/A reflects system control after successful escalation.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service, aka 'Windows Clipboard Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1111, CVE-2020-1165, CVE-2020-1166.
AnalysisAI
Elevation of privilege in the Windows Clipboard Service affects Windows 10 versions 1809, 1903, and 1909 and Windows Server 2019, allowing a locally authenticated low-privileged attacker to gain elevated, likely SYSTEM-level, privileges by sending maliciously crafted calls to the service. The CVSS AC:H metric signals non-trivial attack complexity - consistent with a race condition or timing-dependent exploit path - limiting opportunistic risk. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.82% (53rd percentile), reflecting below-median real-world exploitation probability. Microsoft has released a patch via the MSRC advisory.
Technical ContextAI
The Windows Clipboard Service is a system-level IPC component that brokers clipboard read/write operations between processes. Improper handling of calls to this service - the precise mechanism is unspecified and no CWE is assigned - allows a caller running at low integrity to abuse the service's privileged execution context. The AC:H CVSS metric strongly implies a race condition, handle-reuse, or time-of-check/time-of-use (TOCTOU) pattern rather than a straightforward logic error. Affected CPE strings confirm the scope is limited to Windows 10 builds 1809, 1903, 1909 (cpe:2.3:o:microsoft:windows_10) and Windows Server 2019 including SAC releases 1903 and 1909 (cpe:2.3:o:microsoft:windows_server_2019), pointing to a code path introduced or modified in the 1809 servicing branch.
RemediationAI
Apply the Microsoft security update distributed through Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog as part of the May 2020 Patch Tuesday release cycle. The authoritative advisory is at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1121; the exact KB article and patch version should be confirmed there, as no specific patch version number was provided in the available intelligence. Where immediate patching is not possible, restrict interactive local logon rights on affected systems to the minimum required user set via Group Policy (deny logon locally for non-administrative accounts where operationally feasible), reducing the pool of accounts that could trigger the flaw. Additionally, monitor for anomalous process privilege escalation events (Windows Event ID 4672, 4688) to detect exploitation attempts. Note that restricting local logon carries an operational impact on shared or multi-user systems.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today