CVE-2020-16938

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 2004>= 10.0.0, < publication
MicrosoftWindows Server version 2004>= 10.0.0, < publication

References

Timeline

Published
Oct 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-169397.8<p>An elevation of privilege vulnerability exists when Group Policy improperly checks access. An attacker who successfully exploited this vuCVE-2020-16944.9A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw reCVE-2020-169407.8<p>An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles junction points. An attCVE-2020-169414.1<p>An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering CVE-2020-169424.1<p>An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering CVE-2020-169436.5<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploitedCVE-2020-169448.7<p>This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint servCVE-2020-169458.7<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reqCVE-2020-169468.7<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reqCVE-2020-169477.5<p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. CVE-2020-169486.5<p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker wCVE-2020-169494.7<p>A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An a
CVE-2020-16938: Medium severity, CVSS 5.5 | Vulnix