Windows Win32k CVE-2020-1143
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack via Win32k driver, requiring an existing low-privileged session and high complexity consistent with a race condition; full C/I/A reflects SYSTEM-level kernel access.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1054.
AnalysisAI
Elevation of privilege in the Windows Win32k kernel-mode driver allows a locally authenticated, low-privileged attacker to fully compromise the affected system by exploiting improper memory object handling. Affected platforms span Windows 7 SP1 through Windows 10 version 1909, as well as multiple Windows Server releases, making this broadly applicable across enterprise environments. No public exploit or CISA KEV listing was identified at time of analysis, and the CVSS Attack Complexity rating of High suggests exploitation requires non-trivial conditions such as a race condition or specific system state.
Technical ContextAI
Win32k.sys is the kernel-mode driver responsible for the Windows graphical subsystem, handling window management, graphics rendering, and user-mode GDI/USER API calls that cross the kernel boundary. Improper object handling in memory within this driver - historically a prolific source of Windows privilege escalation - can allow a user-mode process to corrupt kernel memory structures or trigger use-after-free or type confusion conditions, gaining the ability to execute arbitrary code in ring-0 (kernel context). The CWE classification was not assigned by NVD, but given the Win32k driver class and the 'fails to properly handle objects in memory' description, this is consistent with CWE-822 (Untrusted Pointer Dereference), CWE-416 (Use After Free), or CWE-843 (Type Confusion) - common root causes in this subsystem. CPE data confirms affected products include Windows 10 across x86 and x64 variants from RTM through version 1909, and Windows 7 SP1 (x64).
RemediationAI
Apply the Microsoft security update addressing CVE-2020-1143, delivered through the standard Windows Update channel (Patch Tuesday, May 2020). The vendor advisory at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1143 identifies the specific KB articles for each affected Windows version; patch deployment should be prioritized for Windows 7 SP1 endpoints given that OS reached end-of-life in January 2020 and requires Extended Security Update (ESU) enrollment to receive patches. An exact patched version number was not specified in the available data beyond 'patch available per vendor advisory.' As a compensating control where patching is not immediately possible, restricting local user logon rights via Group Policy (denying interactive and remote desktop logon to non-essential accounts) limits the attacker surface, though this carries operational trade-offs for multi-user systems. Least-privilege enforcement - ensuring users do not run with elevated tokens unnecessarily - reduces the utility of this vulnerability as an escalation primitive in an attack chain.
More in Windows Server 2008
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Win32k.sys in Windows Server 2003, Vista, and Server 2008 allows local privilege escalation through a kernel-mode vulner
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today