CVE-2020-16890

published 2020-10-16

CVE-2020-16890: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.

Affected

31 ranges · showing 25

Vendor	Product	Version range	Fixed in
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10_version_1709	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1709_for_32-bit_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1803	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1809	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_32-bit_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_arm64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_x64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1909	>= 10.0.0 < publication	publication
microsoft	windows_10_version_2004	>= 10.0.0 < publication	publication
microsoft	windows_server_2016	—	—
microsoft	windows_server_2016	—	—
microsoft	windows_server_2016	—	—
microsoft	windows_server_2019	>= 10.0.0 < publication	publication
microsoft	windows_server_version_2004	>= 10.0.0 < publication	publication
msrc	windows_10_version_1709	—	—
msrc	windows_10_version_1803	—	—
msrc	windows_10_version_1809	—	—
msrc	windows_10_version_1903	—	—

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

vendor_msrc 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269