Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-1082: Windows Error Reporting Elevation of Privilege Vulnerability

CVE-2020-1082 · published 6 years ago

Summary

Windows Error Reporting on Windows systems can allow attackers to gain more access to sensitive information and system features if they run a specially crafted application. This can happen if the attacker successfully exploits the vulnerability. To protect your system, apply the latest security update.

What to do

Update microsoft windows 10 version 1507 to version publication or later.
Update microsoft windows 10 version 1607 to version publication or later.
Update microsoft windows 10 version 1709 to version publication or later.
Update microsoft windows 10 version 1709 for 32-bit systems to version publication or later.
Update microsoft windows 10 version 1803 to version publication or later.
Update microsoft windows 10 version 1809 to version publication or later.
Update microsoft windows 10 version 1903 for 32-bit systems to version publication or later.
Update microsoft windows 10 version 1903 for arm64-based systems to version publication or later.
Update microsoft windows 10 version 1903 for x64-based systems to version publication or later.
Update microsoft windows 10 version 1909 to version publication or later.
Update microsoft windows server 2016 to version publication or later.
Update microsoft windows server 2016 (server core installation) to version publication or later.
Update microsoft windows server 2019 to version publication or later.
Update microsoft windows server 2019 (server core installation) to version publication or later.
Update microsoft windows server, version 1803 (server core installation) to version publication or later.
Update microsoft windows server, version 1903 (server core installation) to version publication or later.
Update microsoft windows server, version 1909 (server core installation) to version publication or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows 10 version 1507	< publication
microsoft	windows 10 version 1607	< publication
microsoft	windows 10 version 1709	< publication
microsoft	windows 10 version 1709 for 32-bit systems	< publication
microsoft	windows 10 version 1803	< publication
microsoft	windows 10 version 1809	< publication
microsoft	windows 10 version 1903 for 32-bit systems	< publication
microsoft	windows 10 version 1903 for arm64-based systems	< publication
microsoft	windows 10 version 1903 for x64-based systems	< publication
microsoft	windows 10 version 1909	< publication
microsoft	windows server 2016	< publication
microsoft	windows server 2016 (server core installation)	< publication
microsoft	windows server 2019	< publication
microsoft	windows server 2019 (server core installation)	< publication
microsoft	windows server, version 1803 (server core installation)	< publication
microsoft	windows server, version 1903 (server core installation)	< publication
microsoft	windows server, version 1909 (server core installation)	< publication
microsoft	windows_10	1607 1709 1803 1809 1903 1909 `cpe:2.3:o:microsoft:windows_10:-:::::::*`
microsoft	windows_server	1803 `cpe:2.3:o:microsoft:windows_server:1803:::::::*`
microsoft	windows_server_2016	1903 1909 `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`

Original advisory text

Windows Error Reporting Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.
An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.
The security update addresses the vulnerability by correcting the way that WER handles and executes files.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1082
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1082 Patch Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1082 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published21 May 2020

Updated3 Nov 2026

First seen19 Aug 2026

Sources

CVE-2020-1082 · NVD

CVE-2020-1082 · MITRE

Track software like this

Free during beta