What’s Vulnerable › Vulnerabilities

CVE-2020-1054: Win32k Elevation of Privilege Vulnerability

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 53.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-05-21 · updated 2026-10-08
• Weakness: CWE-787

Description

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

Affected products

• Microsoft Windows 10 Version 1507: all versions
• Microsoft Windows 10 1607: all versions
• Microsoft Windows 10 1709: all versions
• Microsoft Windows 10 1803: all versions
• Microsoft Windows 10: all versions
• Microsoft Windows 10 1903: all versions
• Microsoft Windows 10 1909: all versions
• Microsoft Windows 7: all versions
• Microsoft Windows 8.1: all versions
• Microsoft Windows RT 8.1: all versions
• Microsoft Windows Server 1803: all versions
• Microsoft Windows Server 1903: all versions
• Microsoft Windows Server 1909: all versions
• Microsoft Windows Server 2008: r2-sp1
• Microsoft Windows Server 2012: r2
• Microsoft Windows Server 2016: all versions
• Microsoft Windows Server 2019: all versions
• Microsoft Windows 10 Version 1507: from 10.0.10240.0 before publication — fixed in publication
• Microsoft Windows 10 1607: from 10.0.14393.0 before publication — fixed in publication
• Microsoft Windows 10 1709: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 Version 1709 for 32-bit Systems: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 1803: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10: from 10.0.17763.0 before publication — fixed in publication
• Microsoft Windows 10 Version 1903 for 32-bit Systems: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 Version 1903 for ARM64-based Systems: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 Version 1903 for x64-based Systems: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 1909: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 7: from 6.1.0 before publication — fixed in publication
• Microsoft Windows 7 Service Pack 1: from 6.1.0 before publication — fixed in publication
• Microsoft Windows 8.1: from 6.3.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Windows 10 Version 1507 publication; Microsoft Windows 10 1607 publication; Microsoft Windows 10 1709 publication; Microsoft Windows 10 Version 1709 for 32-bit Systems publication; Microsoft Windows 10 1803 publication; Microsoft Windows 10 publication; Microsoft Windows 10 Version 1903 for 32-bit Systems publication; Microsoft Windows 10 Version 1903 for ARM64-based Systems publication; Microsoft Windows 10 Version 1903 for x64-based Systems publication; Microsoft Windows 10 1909 publication; Microsoft Windows 7 publication; Microsoft Windows 7 Service Pack 1 publication. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1054
• http://packetstormsecurity.com/files/160515/Microsoft-Windows-DrawIconEx-Local-Privilege-Escalation.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1054
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1054

Get alerted when CVE-2020-1054 or the next vulnerability affects your stack