Windows Runtime CVE-2020-1151
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access only (AV:L) with low-privilege entry point (PR:L) and high complexity (AC:H) reflecting likely race-condition exploitation; full system impact (C:H/I:H/A:H) if successful, unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1077, CVE-2020-1086, CVE-2020-1090, CVE-2020-1125, CVE-2020-1139, CVE-2020-1149, CVE-2020-1155, CVE-2020-1156, CVE-2020-1157, CVE-2020-1158, CVE-2020-1164.
AnalysisAI
Elevation of privilege in the Windows Runtime component allows a local, low-privileged attacker to escalate to full system control on Windows 10 (versions 1709 through 1909) and Windows Server 2016/2019 by exploiting improper in-memory object handling. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires an existing local foothold and high attack complexity, meaning this is a post-compromise escalation primitive rather than an initial access vector. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though its EPSS score of 3.03% (86th percentile) places it above the vast majority of CVEs in relative exploitation probability.
Technical ContextAI
The Windows Runtime (WinRT) is the core application framework underpinning Universal Windows Platform (UWP) applications and is deeply integrated into the Windows 10 and Windows Server 2016/2019 operating systems. The vulnerability arises from improper handling of objects in memory within the WinRT subsystem - the exact root-cause class is unspecified (CWE is listed as N/A), but the high attack complexity (AC:H) in the CVSS vector is consistent with race conditions, use-after-free scenarios, or type confusion bugs that require specific timing or environmental conditions to trigger reliably. Affected CPE strings confirm the scope spans Windows 10 semi-annual channel builds 1709, 1803, 1809, 1903, and 1909, as well as the corresponding Windows Server 2016 channel releases and Windows Server 2019 RTM. This vulnerability is one of at least eleven distinct Windows Runtime EoP issues patched in the same release cycle (CVE-2020-1077, -1086, -1090, -1125, -1139, -1149, -1155, -1156, -1157, -1158, -1164), suggesting systemic memory management deficiencies in the WinRT object lifecycle.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1151 via Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog. The exact patched build version is not independently confirmed from the provided data - verify the specific KB article number through the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1151. For systems where immediate patching is not feasible, restrict interactive logon rights to trusted accounts only using Group Policy (Deny log on locally, Deny log on through Remote Desktop Services), which directly addresses the PR:L local access prerequisite. Limiting the attack surface to trusted users reduces the pool of potential attackers but does not eliminate the vulnerability; the trade-off is administrative overhead and potential operational disruption for shared workstations or terminal server environments. Prioritize patching Windows Server 2019 and 2016 systems where interactive access may be granted to lower-privileged service accounts.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today