CVE-2020-1238

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1239.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-123807.8Out of bounds read in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow an CVE-2020-123847.8Improper access control in some Intel(R) Graphics Drivers before version 26.20.100.8476 may allow an authenticated user to potentially enabl CVE-2020-123857.8Improper input validation in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable CVE-2020-123865.5Out-of-bounds write in some Intel(R) Graphics Drivers before version 15.36.39.5143 may allow an authenticated user to potentially enable den CVE-2020-123878.1A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable CVE-2020-1238810.0The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only af CVE-2020-1238910.0The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only af CVE-2020-12398.8A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Co CVE-2020-123909.8Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.CVE-2020-123917.5Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scri CVE-2020-123925.5The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the CVE-2020-123937.8The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the web