CVE-2020-1135: Windows Graphics Component Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'.
Other sources
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. In a local attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to take control over the affected system. The update addresses the vulnerability by correcting the way in which the Microsoft Graphics Component handles objects in memory and preventing unintended elevation from user mode.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556799 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556812 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4551853 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556807
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs local access and the ability to run a specially crafted application on an affected system. The CVSS vector indicates low attack complexity, low privileges required, and no user interaction.
What is the impact of successful exploitation?
Successful exploitation lets an attacker run processes in an elevated context and take control of the affected system. Confidentiality, integrity, and availability impacts are all rated High in the supplied CVSS vector.
Which systems are identified as affected?
The listed affected software includes Microsoft Windows 10, Microsoft Windows Server 2016, and Microsoft Windows Server 2019.
What does the security update change?
The update corrects how the Microsoft Graphics Component handles objects in memory and prevents unintended elevation from user mode.