PT-2020-3731 · Microsoft · Edge
Published
2020-08-11
·
Updated
2024-01-19
·
CVE-2020-1568
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Microsoft Edge (affected versions not specified)
Description:
A remote code execution issue exists due to improper handling of objects in memory by the Microsoft Edge PDF Reader. This could allow an attacker to execute arbitrary code in the context of the current user, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited through a web-based attack scenario, where an attacker hosts a website with malicious PDF content. However, the attacker would need to convince a user to view the malicious content, as they cannot force the user to do so.
Recommendations:
To resolve the issue, apply the security update that modifies how Microsoft Edge PDF Reader handles objects in memory.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Edge