[ CVE-2020-1027 · Published 15 Apr 2020 ]
Microsoft Windows Kernel Privilege Escalation Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 5%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-23
[ Description ]Official description
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003.
CISA: An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 13 Jun 2022): Apply updates per vendor instructions.
- Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/168068/Windows-sxs-CNodeFactory-XMLParser_Element_doc_ass…ExploitThird Party AdvisoryVDB Entry
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1027PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource