PT-2020-2521 · Microsoft · Windows

Bee13Oy + 2 · Published 2020-05-12 · Updated 2025-10-29 · CVE-2020-1054

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to 10.0.18363

Description An elevation of privilege issue exists due to the Windows kernel-mode driver's failure to properly handle objects in memory. This allows an attacker to potentially elevate their privileges. The issue is related to errors in processing objects in memory.

Recommendations For Windows versions prior to 10.0.18363, update to a version that includes the necessary security patches to resolve the issue. As a temporary workaround, consider restricting access to sensitive system resources to minimize the risk of exploitation.

Exploit

Fix

LPE

Improper Privilege Management

Memory Corruption

Weakness Enumeration

CWE-269

CWE-787

Related Identifiers

BDU:2020-02532

CVE-2020-1054

Affected Products

Windows

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb · Exploit
• 🔥 https://github.com/0xeb-bp/cve-2020-1054 · Exploit
• 🔥 https://github.com/KaLendsi/CVE-2020-1054 · Exploit
• 🔥 https://github.com/Iamgublin/CVE-2020-1054 · Exploit
• 🔥 http://packetstormsecurity.com/files/160515/Microsoft-Windows-DrawIconEx-Local-Privilege-Escalation.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1054 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1054 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1054 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1054 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02532 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1054 · Vendor Advisory
• https://t.me/avleonovcom/1234 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1054 · Note
• https://t.me/aptreports/1707 · Telegram Post