CVE-2020-1115

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

<p>An elevation of privilege vulnerability exists when the <a href="https://technet.microsoft.com/library/security/dn848375.aspx#CLFS">Windows Common Log File System (CLFS)</a> driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p> <p>To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.</p> <p>The security update addresses the vulnerability by correcting how CLFS handles objects in memory.</p>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-111506.7Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of poinCVE-2020-111516.4Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon ACVE-2020-111526.4Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects inCVE-2020-111539.8u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution'CVE-2020-111548.8u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon CVE-2020-111558.8u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon AutoCVE-2020-111568.1u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in SnapdragCVE-2020-111577.5u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in SCVE-2020-111587.5u'Null pointer dereference in HP OfficeJet Pro 8210 jbig2 filter due to lack of check of PDF font array leads to denial of service' in IPS PCVE-2020-111599.1Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer beinCVE-2020-11165.5An information disclosure vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects inCVE-2020-111606.7Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdrag
CVE-2020-1115: High severity, CVSS 7.8 | Vulnix