CVE-2020-1129
Last modified
CVE-2020-1129 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. <p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. EPSS estimates a 3.76% chance of exploitation in the next 30 days.
Description
<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p> <p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 | 1607 |
| Microsoft | Windows 10 | 1709 |
| Microsoft | Windows 10 | 1803 |
| Microsoft | Windows 10 | 1809 |
| Microsoft | Windows 10 | 1903 |
| Microsoft | Windows 10 | 1909 |
| Microsoft | Windows 10 | 2004 |
| Microsoft | Windows Server 2016 | All versions |
| Microsoft | Windows Server 2016 | 1903 |
| Microsoft | Windows Server 2016 | 1909 |
| Microsoft | Windows Server 2016 | 2004 |
| Microsoft | Windows Server 2019 | All versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1129Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1129Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1129?
How severe is CVE-2020-1129?
How do I fix CVE-2020-1129?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11284Locked memory can be unlocked and modified by non secure boo…7.8
- CVE-2020-11285Buffer over-read while unpacking the RTCP packet we may read…9.1
- CVE-2020-11286An Untrusted Pointer Dereference can occur while doing USB c…6.8
- CVE-2020-11287Allowing RTT frames to be linked with non randomized MAC add…7.5
- CVE-2020-11288Out of bound write can occur in playready while processing c…7.8
- CVE-2020-11289Out of bound write can occur in TZ command handler due to la…7.8
- CVE-2020-11290Use after free condition in msm ioctl events due to race bet…7
- CVE-2020-11291Possible buffer overflow while updating ikev2 parameters for…9.8
- CVE-2020-11292Possible buffer overflow in voice service due to lack of inp…7.8
- CVE-2020-11293Out of bound read can happen in Widevine TA while copying da…6
- CVE-2020-11294Out of bound write in logger due to prefix size is not valid…7.8
- CVE-2020-11295Use after free in camera If the threadmanager is being clean…7.8
Are you affected by CVE-2020-1129?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST