CVE-2020-1303

Windows Runtime Elevation of Privilege Vulnerability

At a glance

Severity: MEDIUM 5.5
EPSS: EPSS 4.26 % · percentile 91 (2026-10-27)
State: PUBLISHED
Published: 2020-09-11
Updated: 2024-08-04
Assigner: microsoft
NVD status: Modified

Description

An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way the Windows Runtime handles objects in memory.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C	microsoft
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	NVD · secure@microsoft.com (Secondary)
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Secondary)
CVSS 2.0	MEDIUM 6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2020-12181
GCVE · GCVE-0-2020-1303

CERT-FR advisories

CERTFR-2020-AVI-562 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Affected products

Product	Versions
Microsoft · Windows 10 Version 1803	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1809	affected 10.0.0 < publication
Microsoft · Windows Server 2019	affected 10.0.0 < publication
Microsoft · Windows Server 2019 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1909	affected 10.0.0 < publication
Microsoft · Windows Server, version 1909 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for 32-bit Systems	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for x64-based Systems	affected 10.0.0 < publication
Microsoft · Windows 10 Version 1903 for ARM64-based Systems	affected 10.0.0 < publication
Microsoft · Windows Server, version 1903 (Server Core installation)	affected 10.0.0 < publication
Microsoft · Windows 10 Version 2004	affected 10.0.0 < publication
Microsoft · Windows Server version 2004	affected 10.0.0 < publication

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1303

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD