Windows Runtime CVE-2020-1164
HIGHSeverity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low-privilege user required; high complexity reflects likely race condition; full C/I/A impact consistent with SYSTEM-level privilege escalation.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1077, CVE-2020-1086, CVE-2020-1090, CVE-2020-1125, CVE-2020-1139, CVE-2020-1149, CVE-2020-1151, CVE-2020-1155, CVE-2020-1156, CVE-2020-1157, CVE-2020-1158.
AnalysisAI
Elevation of privilege in the Windows Runtime component affects Windows 10 (all major feature releases through 1909) and Windows Server 2016, allowing a locally authenticated low-privilege user to gain full system-level access through improper memory object handling. Exploitation requires high attack complexity - likely a race condition or timing-dependent memory corruption - and local access, limiting opportunistic mass exploitation. No public exploit code or CISA KEV listing is present, though the 86th-percentile EPSS score suggests meaningful attacker interest relative to peers.
Technical ContextAI
Windows Runtime (WinRT) is the application programming interface underpinning Universal Windows Platform (UWP) applications on Windows 10 and Windows Server 2016. The vulnerability stems from improper handling of objects in memory - consistent with use-after-free, race condition, or type confusion patterns common in runtime environments - though no CWE is formally assigned in NVD. The CVSS vector AV:L/AC:H/PR:L confirms the flaw is reachable from user-space code with standard user privileges but requires precise exploitation conditions, suggesting a non-trivial memory safety defect in WinRT's object lifecycle management. Affected CPE strings span cpe:2.3:o:microsoft:windows_10 across versions RTM through 1909, and cpe:2.3:o:microsoft:windows_server_2016 including versions 1803 and 1903.
RemediationAI
Apply the vendor-released patch available through Microsoft's May 2020 Patch Tuesday security update cycle, referenced at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1164 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1164. The exact patched build version is not independently confirmed beyond 'patch available per vendor advisory' - consult the MSRC advisory for specific KB article numbers applicable to each Windows 10 feature version. As a compensating control where patching is not immediately possible, restricting interactive or remote logon rights to only trusted accounts reduces the pool of potential attackers, though this does not eliminate the risk if a low-privilege attacker account already exists on the system. Applying Windows Defender Application Control (WDAC) or AppLocker policies to limit unsigned or untrusted code execution can also reduce the attack surface, at the cost of restricting legitimate UWP application usage.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today