CVE-2020-16890

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

<p>An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-168918.8<p>A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticatedCVE-2020-168927.8<p>An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who succesCVE-2020-168947.7<p>A denial of service vulnerability exists when Windows Network Address Translation (NAT) on a host server fails to properly validate inputCVE-2020-168957.8<p>An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who sCVE-2020-168967.5<p>An information disclosure vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP CVE-2020-168975.5<p>An information disclosure vulnerability exists when NetBIOS over TCP (NBT) Extensions (NetBT) improperly handle objects in memory. An attCVE-2020-168988.8<p>A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attCVE-2020-168997.5<p>A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attackeCVE-2020-16906.5An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a containerCVE-2020-169007.0<p>An elevation of privilege vulnerability exists when the Windows Event System improperly handles objects in memory.</p> <p>To exploit thisCVE-2020-169015.0<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vCVE-2020-169027.8<p>An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leadi
CVE-2020-16890: High severity, CVSS 7.8 | Vulnix