CVE-2020-24567

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-08-21 · updated 2026-06-17

Description

voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuration error

Affected products

voidtools Everything: before 1.4.1.990 — fixed in 1.4.1.990

How to fix

Upgrade to a fixed version: voidtools Everything 1.4.1.990. Check the vendor advisory for mitigations.

References

https://www.cymaera.com/articles/everything.html
https://www.voidtools.com/forum/viewtopic.php?p=32509#p32509
https://www.cymaera.com/articles/everything.html
https://www.voidtools.com/forum/viewtopic.php?p=32509#p32509

Get alerted when CVE-2020-24567 or the next vulnerability affects your stack