CVE-2020-0708

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1709 for ARM64-based Systems; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1
MicrosoftWindows Serverversion 1803 (Core Installation); 2019; 2019 (Core installation); 2016; 2016 (Core installation); 2008 for 32-bit Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2008 for Itanium-Based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation); 2008 R2 for Itanium-Based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation)
MicrosoftWindows 10 Version 1909 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1909 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1909 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1909 (Server Core installation)unspecified
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Feb 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-07097.8An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege VulnerCVE-2020-07107.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07117.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07127.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07137.5A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginCVE-2020-07145.5An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerCVE-2020-07157.8An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiCVE-2020-07165.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisCVE-2020-07175.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisCVE-2020-07188.8<p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticatedCVE-2020-07197.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2020-07207.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
CVE-2020-0708: High severity, CVSS 7.8 | Vulnix