What’s Vulnerable › Vulnerabilities
CVE-2020-1012: WinINet API Elevation of Privilege Vulnerability
- Severity: medium (CVSS 6.8 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-09-11 · updated 2026-06-17
Description
<p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>There are multiple ways an attacker could exploit the vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit this vulnerability, and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by ensuring the Wininit.dll properly handles objects in memory.</p>
Affected products
- Microsoft Internet Explorer 11: 11
- Microsoft Internet Explorer 11: from 1.0.0 before publication — fixed in publication
How to fix
Upgrade to a fixed version: Microsoft Internet Explorer 11 publication. Check the vendor advisory for mitigations.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1012
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1012
Get alerted when CVE-2020-1012 or the next vulnerability affects your stack