CVE-2020-1222

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Microsoft Store Runtime improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Microsoft Store Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1309.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 2004 for ARM64-based Systems	unspecified
Microsoft	Windows	10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1709 for ARM64-based Systems
Microsoft	Windows Server	version 1803 (Core Installation); 2019; 2019 (Core installation)
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified
Microsoft	Windows Server, version 2004 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 2004 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1222Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1222Patch, Vendor Advisory

Timeline

Published: Jun 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-12238.8A remote code execution vulnerability exists when Microsoft Word for Android fails to properly handle certain files.To exploit the vulnerabi CVE-2020-12245.5<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who expl CVE-2020-122427.8Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a dif CVE-2020-122437.5In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon CVE-2020-122447.5An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA w CVE-2020-122456.1Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.CVE-2020-122468.8Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, th CVE-2020-122477.1In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds CVE-2020-122488.8In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer over CVE-2020-12258.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2020-122512.2An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (in CVE-2020-122526.2An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an authenticated user. If