CVE-2020-1256

MEDIUM

Windows GDI - Information Disclosure via Memory Handling

Title source: llm
STIX 2.1

Description

<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.</p>

References (1)

Core 1
Core References

Scores

CVSS v3 5.5
EPSS 0.0460
EPSS Percentile 90.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

Status published
Products (17)
microsoft/windows_10
microsoft/windows_10 1607
microsoft/windows_10 1709
microsoft/windows_10 1803
microsoft/windows_10 1809
microsoft/windows_10 1903
microsoft/windows_10 2004
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
... and 7 more
Published Sep 11, 2020
Tracked Since Feb 18, 2026