CVE-2020-1067 - Windows Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

Windows Remote Code Execution Vulnerability

Published May 21, 2020

7.8

HIGH

CVSS 3.1

EPSS 2.52%

Description

A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker who has a domain user account could create a specially crafted request, causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows handles objects in memory.

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
unknown
Affected
- ≥ 10.0.10240.0, < publication
Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.14393.0, < publication
Vendor Microsoft Product Windows 10 Version 1709 Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1709 for 32-bit Systems Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1803 Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.0, < publication
- ≥ 10.0.17763.0, < publication
Vendor Microsoft Product Windows 10 Version 1903 for 32-bit Systems Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1903 for ARM64-based Systems Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1903 for x64-based Systems Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 10 Version 1909 Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows 7 Default
unknown
Affected
- ≥ 6.1.0, < publication
Vendor Microsoft Product Windows 7 Service Pack 1 Default
unknown
Affected
- ≥ 6.1.0, < publication
Vendor Microsoft Product Windows 8.1 Default
unknown
Affected
- ≥ 6.3.0, < publication
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 Default
unknown
Affected
- ≥ 6.1.7601.0, < publication
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 (Server Core installation) Default
unknown
Affected
- ≥ 6.1.7601.0, < publication
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
unknown
Affected
- ≥ 6.0.6003.0, < publication
Vendor Microsoft Product Windows Server 2008 Service Pack 2 (Server Core installation) Default
unknown
Affected
- ≥ 6.0.6003.0, < publication
Vendor Microsoft Product Windows Server 2012 Default
unknown
Affected
- ≥ 6.2.9200.0, < publication
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
unknown
Affected
- ≥ 6.2.9200.0, < publication
Vendor Microsoft Product Windows Server 2012 R2 Default
unknown
Affected
- ≥ 6.3.9600.0, < publication
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
unknown
Affected
- ≥ 6.3.9600.0, < publication
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.14393.0, < publication
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.14393.0, < publication
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.17763.0, < publication
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.17763.0, < publication
Vendor Microsoft Product Windows Server, version 1803 (Server Core Installation) Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows Server, version 1903 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.0, < publication
Vendor Microsoft Product Windows Server, version 1909 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.0, < publication

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1507	unknown	Affected ≥ 10.0.10240.0, < publication
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.14393.0, < publication
Microsoft	Windows 10 Version 1709	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1709 for 32-bit Systems	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1803	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.0, < publication ≥ 10.0.17763.0, < publication
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1903 for x64-based Systems	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 10 Version 1909	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows 7	unknown	Affected ≥ 6.1.0, < publication
Microsoft	Windows 7 Service Pack 1	unknown	Affected ≥ 6.1.0, < publication
Microsoft	Windows 8.1	unknown	Affected ≥ 6.3.0, < publication
Microsoft	Windows Server 2008 R2 Service Pack 1	unknown	Affected ≥ 6.1.7601.0, < publication
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	unknown	Affected ≥ 6.1.7601.0, < publication
Microsoft	Windows Server 2008 Service Pack 2	unknown	Affected ≥ 6.0.6003.0, < publication
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	unknown	Affected ≥ 6.0.6003.0, < publication
Microsoft	Windows Server 2012	unknown	Affected ≥ 6.2.9200.0, < publication
Microsoft	Windows Server 2012 (Server Core installation)	unknown	Affected ≥ 6.2.9200.0, < publication
Microsoft	Windows Server 2012 R2	unknown	Affected ≥ 6.3.9600.0, < publication
Microsoft	Windows Server 2012 R2 (Server Core installation)	unknown	Affected ≥ 6.3.9600.0, < publication
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.14393.0, < publication
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.14393.0, < publication
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.17763.0, < publication
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.17763.0, < publication
Microsoft	Windows Server, version 1803 (Server Core Installation)	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows Server, version 1903 (Server Core installation)	unknown	Affected ≥ 10.0.0, < publication
Microsoft	Windows Server, version 1909 (Server Core installation)	unknown	Affected ≥ 10.0.0, < publication

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-11958
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1067
vendor-advisorypatch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1067
PatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-11958		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1067		vendor-advisorypatch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1067		PatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published May 21, 2020

Updated Aug 19, 2026

Reserved Nov 4, 2019

Link CVE-2020-1067

CISA Vulnrichment

No data

NVD

Status Modified

Modified Aug 19, 2026

Link CVE-2020-1067

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published May 21, 2020

Updated Aug 19, 2026

Link EUVD-2020-11958

GitHub

No data