Microsoft Windows up to Server 2019 Graphics dynamically-managed code resources

Summaryinfo

A vulnerability classified as problematic has been found in Microsoft Windows. This issue affects some unknown processing of the component Graphics Component. The manipulation leads to dynamically-managed code resources. This vulnerability is documented as CVE-2020-1091. The attack can be initiated remotely. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System). It has been rated as problematic. This issue affects some unknown processing of the component Graphics Component. The manipulation with an unknown input leads to a dynamically-managed code resources vulnerability. Using CWE to declare the problem leads to CWE-913. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements. Impacted is confidentiality. The summary by CVE is:

<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system.</p> <p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document or by convincing a user to visit an untrusted webpage.</p> <p>The update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.</p>

The weakness was released 09/08/2020 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release was coordinated with Microsoft. The identification of this vulnerability is CVE-2020-1091. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/24/2026). The advisory points out:

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-160900, VDB-160899, VDB-160898 and VDB-160897. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• 8.1
• 10
• 10 1607
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• 10 1909
• 10 2004
• RT 8.1
• Server 1903
• Server 1909
• Server 2004
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion