Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-1412: A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.

CVE-2020-1412 · published 6 years ago

Summary

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1607 1709 1803 1809 1903 1909 2004 `cpe:2.3:o:microsoft:windows_10:-::::::x64:`
microsoft	windows_7	All versions `cpe:2.3:o:microsoft:windows_7:-:sp1:::::x64:*`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1:-::::::x64:`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2008	All versions `cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	1903 1909 2004 `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`

Original advisory text

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1412 Patch Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-i... Not Applicable

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

14% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published14 Jul 2020

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2020-1412 · NVD

Track software like this

Free during beta