CVE-2020-1081

HighCVSS 7.8/10Last modified Aug 19, 2026

Description

An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers. An authenticated attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how the Windows Printer Service validates file paths.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2020
Last modified
Aug 19, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-108105.5An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It aCVE-2020-108115.5An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5OlayoCVE-2020-108125.5An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It CVE-2020-108137.5A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet.CVE-2020-108145.5A buffer overflow vulnerability in Code::Blocks 17.12 allows an attacker to execute arbitrary code via a crafted project file.CVE-2020-108167.5Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestPCVE-2020-108178.8The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NCVE-2020-108187.2Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field.CVE-2020-108194.8Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.CVE-2020-10827.8An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability couldCVE-2020-108204.8Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.CVE-2020-108214.8Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVE-2020-1081: High severity, CVSS 7.8 | Vulnix