PT-2020-3674 · Microsoft · Windows

Published 2020-08-11 · Updated 2026-02-23 · CVE-2020-1459

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to the fixed version

Description The issue is related to an information disclosure vulnerability in ARM implementations of Windows, which is connected to the lack of protection for service data. This vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information. The vulnerability exists due to speculative execution in control flow via a side-channel analysis, also known as "straight-line speculation." To exploit this, an attacker with local privileges would need to run a specially crafted application.

Recommendations For Windows versions prior to the fixed version, the security update addresses the vulnerability by bypassing the speculative execution, thus resolving the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

BDU:2020-04022

CVE-2020-1459

Affected Products

Windows

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1459 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1459 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04022 · Security Note
• https://t.me/cvenotify/67948 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020081223 · Note
• https://t.me/cveNotify/152906 · Telegram Post