CVE-2020-0708

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-07097.8An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege VulnerCVE-2020-07107.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07117.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07127.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07137.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07145.5An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerCVE-2020-07157.8An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiCVE-2020-07165.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisCVE-2020-07175.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisCVE-2020-07188.8<p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticatedCVE-2020-07197.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2020-07207.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
CVE-2020-0708: High severity, CVSS 7.8 | Vulnix