CVE-2020-1139

HighCVSS 7.8/10Last modified Aug 19, 2026

Description

An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way the Windows Runtime handles objects in memory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-11407.8An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi CVE-2020-11415.5An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allow CVE-2020-114147.5An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight ex CVE-2020-114154.9An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP ser CVE-2020-114165.4JetBrains Space through 2020-04-22 allows stored XSS in Chats.CVE-2020-11427.8An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An att CVE-2020-114206.5UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerabili CVE-2020-11437.0An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An CVE-2020-114319.1The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated at CVE-2020-114369.0LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including admini CVE-2020-114374.3LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database.CVE-2020-114388.8LibreHealth EMR v2.0.0 is affected by systemic CSRF.