CVE-2020-1116: Windows CSRSS Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windows CSRSS Information Disclosure Vulnerability'.
Other sources
An information disclosure vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application. The update addresses the vulnerability by correcting how the Windows CSRSS handles objects in memory.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4551853 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556799 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556807 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556843 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556852 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556853 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556854 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556846 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556813 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556826 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556812
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1116?
CVE-2020-1116 has a CVSS score that categorizes it as a critical information disclosure vulnerability.
How does CVE-2020-1116 affect users?
CVE-2020-1116 can allow an attacker to disclose sensitive information from memory, potentially compromising user data.
How do I fix CVE-2020-1116?
To fix CVE-2020-1116, you should apply the latest Windows security updates provided by Microsoft.
Which versions of Windows are affected by CVE-2020-1116?
CVE-2020-1116 affects multiple versions of Windows 10, Windows 7, Windows 8.1, and various Windows Server editions.
Is CVE-2020-1116 exploitable remotely?
CVE-2020-1116 can potentially be exploited by an attacker with local access to the system.