CVE-2020-1374

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 2004 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 2004 for ARM64-based Systemsunspecified
MicrosoftWindows 10 Version 2004 for x64-based Systemsunspecified
MicrosoftWindows Server, version 2004 (Server Core installation)unspecified
MicrosoftWindows10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1709 for ARM64-based Systems; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1
MicrosoftWindows Server2019; 2019 (Core installation); 2016; 2016 (Core installation); 2008 R2 for x64-based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation)
MicrosoftWindows 10 Version 1909 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1909 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1909 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1909 (Server Core installation)unspecified
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Jul 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-13757.8An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of PriCVE-2020-1375310.0The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.CVE-2020-137546.7hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.CVE-2020-137569.8Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectoCVE-2020-137577.5Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.CVE-2020-137586.1modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by CVE-2020-137597.5rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obCVE-2020-13767.8<p>An elevation of privilege vulnerability exists in the way that fdSSDP.dll handles objects in memory. An attacker who successfully exploitCVE-2020-137608.8In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.CVE-2020-137616.1In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modulCVE-2020-137626.1In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.CVE-2020-137637.5In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
CVE-2020-1374: High severity, CVSS 7.5 | Vulnix