CVE-2020-0998: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run proce...

Summary

An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
In a local attack scenario, an attacker could exploit this vulnerab...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1607 1709 1803 1809 1903 1909 2004 `cpe:2.3:o:microsoft:windows_10:-::::::x64:`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1:-::::::x64:`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*`
microsoft	windows_server_2016	1903 1909 2004 `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`

Original advisory text

An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run proce...

An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
In a local attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to take control over the affected system.
The update addresses the vulnerability by correcting the way in which the Microsoft Graphics Component handles objects in memory and preventing unintended elevation from user mode.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0998 Patch Vendor Advisory

CVE-2020-0998: <p>An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run proce...