Windows Runtime CVE-2020-1149
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector with low-privilege requirement matches description; high complexity reflects likely race condition; full C/I/A impact within unscoped system is consistent with EoP to SYSTEM-level.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1077, CVE-2020-1086, CVE-2020-1090, CVE-2020-1125, CVE-2020-1139, CVE-2020-1151, CVE-2020-1155, CVE-2020-1156, CVE-2020-1157, CVE-2020-1158, CVE-2020-1164.
AnalysisAI
Elevation of privilege in Windows Runtime allows a local authenticated low-privileged attacker to gain full system-level access by exploiting improper memory object handling across a broad range of Windows versions from Windows 7 SP1 through Windows 10 1909. The CVSS vector (AV:L/AC:H/PR:L) confirms this is a local-only attack requiring an existing foothold but not administrative rights, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the EPSS score of 3.03% at the 86th percentile indicates elevated exploitation likelihood relative to the broader CVE population.
Technical ContextAI
Windows Runtime (WinRT) is a platform-agnostic application execution environment introduced in Windows 8, underpinning Windows Store and Universal Windows Platform (UWP) applications. The vulnerability resides in how the Windows Runtime subsystem handles objects in memory - while NVD does not assign a formal CWE, this class of improper memory object handling typically encompasses use-after-free, type confusion, or improper reference counting, all of which can corrupt memory state in controlled ways to redirect execution flow. CPE data confirms the affected surface spans Windows 10 RTM and versions 1607, 1709, 1803, 1809, 1903, and 1909, as well as the legacy platforms Windows 7 SP1, Windows 8.1, and Windows RT 8.1, indicating the vulnerable code path is shared across the Windows Runtime implementation on both modern and legacy OS branches. Server editions (Windows Server 2012, 2016, 2019) are referenced in the tags but are not reflected in the provided CPE strings - verify with vendor advisory.
RemediationAI
Apply the Microsoft security update addressing CVE-2020-1149, available via the MSRC advisory at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1149 and the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1149. The patch is confirmed available per vendor; however, the specific KB article number and exact fixed build version are not independently confirmed from the provided data - consult the MSRC portal directly to identify the correct update for each affected Windows version. For environments where immediate patching is not feasible, the most actionable compensating control is restricting interactive logon rights to trusted accounts only, as the attack vector is strictly local (AV:L) and requires low-privilege authenticated access (PR:L). Disabling or restricting access to Windows Runtime-dependent UWP application features may reduce attack surface but could impact application functionality and is not a confirmed mitigation without vendor guidance. Prioritize patching on Remote Desktop Session Hosts, Citrix/VDI environments, and shared-access workstations where untrusted low-privilege users hold interactive sessions.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today