CVE-2020-1421: Microsoft Windows LNK File Parsing Type Confusion Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of LNK files in StructuredQuery.dll. A crafted LeafCondition element can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1421?
CVE-2020-1421 is rated as important due to its potential for remote code execution.
How do I fix CVE-2020-1421?
To fix CVE-2020-1421, ensure your Microsoft Windows is updated with the latest security patches provided by Microsoft.
What systems are affected by CVE-2020-1421?
CVE-2020-1421 affects multiple versions of Microsoft Windows 10 and Windows Server 2016 and 2019.
What type of vulnerability is CVE-2020-1421?
CVE-2020-1421 is classified as a remote code execution vulnerability.
Can CVE-2020-1421 be exploited without user interaction?
Yes, CVE-2020-1421 can be exploited when a malicious .LNK file is processed by the affected system.