CVE-2020-1015

HIGH

Windows - Elevation of Privilege via User-Mode Power Service Memory Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-1015. PoCs published by 0xeb-bp.

AI-analyzed exploit summary This PoC exploits CVE-2020-1015, a local privilege escalation vulnerability in Windows via the UmpoRpcLegacyEventRegisterNotification RPC function. It triggers a race condition by rapidly registering and unregistering a service with a long name, leading to a crash or potential privilege escalation.

Description

An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0934, CVE-2020-0983, CVE-2020-1009, CVE-2020-1011.

Exploits (1)

nomisec WORKING POC 39 stars

by 0xeb-bp · poc

https://github.com/0xeb-bp/cve-2020-1015

View Code ZIP pw:eip

This PoC exploits CVE-2020-1015, a local privilege escalation vulnerability in Windows via the UmpoRpcLegacyEventRegisterNotification RPC function. It triggers a race condition by rapidly registering and unregistering a service with a long name, leading to a crash or potential privilege escalation.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Microsoft Windows (versions affected by CVE-2020-1015)

No auth needed

Prerequisites: Local access to the target system · Compilation with Visual Studio and RPC dependencies

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1015

Scores

CVSS v3 7.8

EPSS 0.0255

EPSS Percentile 83.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (19)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_10 1903

microsoft/windows_10 1909

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

... and 9 more

Published Apr 15, 2020

Tracked Since Feb 18, 2026