Vulnerability Intelligence

CVE-2020-1054

High 7.0 Exploited in the wild (KEV)

Published
Last modified
NVD status
Analyzed

CISA KEV catalog

Confirmed active exploitation.

Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.

CISA KEV
Name
Microsoft Win32k Privilege Escalation Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

Affected products

microsoft: windows 10 1507; microsoft: windows 10 1607; microsoft: windows 10 1709; microsoft: windows 10 1803; microsoft: windows 10 1809; microsoft: windows 10 1903; microsoft: windows 10 1909; microsoft: windows 7; microsoft: windows 8.1; microsoft: windows rt 8.1; microsoft: windows server 1803; microsoft: windows server 1903; microsoft: windows server 1909; microsoft: windows server 2008; microsoft: windows server 2012

References4

Metrics

CVSS 3.1
7.0 HIGH Score source: NVD CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
54% percentile: 99 · as of 2 November 2026
CWE
CWE-787