CVE-2020-1434

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync Host Service Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 2004 for ARM64-based Systems	unspecified
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified
Microsoft	Windows Server, version 2004 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 2004 for 32-bit Systems	unspecified
Microsoft	Windows	10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1709 for ARM64-based Systems; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems
Microsoft	Windows Server	2019; 2019 (Core installation); 2016; 2016 (Core installation)
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1434Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1434Patch, Vendor Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143405.9A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage col CVE-2020-143412.7The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connec CVE-2020-143427.0It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary co CVE-2020-143439.8A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it pro CVE-2020-143446.7An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version CVE-2020-143457.8A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege esca CVE-2020-143467.8A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead CVE-2020-143475.5A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases wh CVE-2020-143484.3It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AM CVE-2020-143497.1It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical rep CVE-2020-14358.8A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka CVE-2020-143507.3It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privil