CVE-2020-1129

Microsoft Windows Codecs Library Remote Code Execution Vulnerability

High · published September 11, 2020

CVSS v3.1
8.8
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>

<p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p>

<p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.04181 · 90.9th percentile
Published
2020-09-11T17:09Z
EPSS history
Timeline
  • 11 SEP 17:09Z
    Microsoft Windows Codecs Library Remote Code Execution Vulnerability
    cvelistv5