CVE-2020-1167

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p> <p>To exploit the vulnerability, a user would have to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.</p>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-116718.1Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to becomeCVE-2020-116739.8An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delCVE-2020-116748.8Cerner medico 26.00 allows variable reuse, possibly causing data corruption.CVE-2020-116758.8Cerner medico 26.00 has a Local Buffer Overflow (issue 1 of 3).CVE-2020-116768.8Cerner medico 26.00 has a Local Buffer Overflow (issue 2 of 3).CVE-2020-116778.8Cerner medico 26.00 has a Local Buffer Overflow (issue 3 of 3).CVE-2020-116798.8Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/UserCVE-2020-116806.5Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a reCVE-2020-116818.1Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit thisCVE-2020-116826.5Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, andCVE-2020-116836.8A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC valuCVE-2020-116849.1AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged
CVE-2020-1167: High severity, CVSS 7.8 | Vulnix