CVE-2020-1117: Microsoft Color Management Remote Code Execution Vulnerability
CVE-2020-1117 is a remote code execution vulnerability in Microsoft Color Management, rated Critical by Microsoft, with a CVSS 3.0 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 4.09% probability of exploitation activity in the next 30 days, higher than 91% of all scored vulnerabilities. Microsoft released the fix on 12 May 2020 in the May 2020 Patch Tuesday, delivered through 5 security updates (KB4556807, KB4551853, KB4556799, KB4556812 and more). It affects 24 products in 1 product family (Windows).
Key facts
- CVE ID
- CVE-2020-1117
- Severity
- High CVSS 8.8
- Microsoft severity
- Critical
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- EPSS
- 4.09% (percentile 91%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2020 Patch Tuesday
- Product families
- Windows
CVSS score and vector
Microsoft scores CVE-2020-1117 at 8.8 (temporal 7.9) using CVSS 3.0. Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 8.8 (HIGH) with CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Description
A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.
The security update addresses the vulnerability by correcting how Color Management Module handles objects in memory.
Affected products (24)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows 10 Version 1803 for 32-bit Systems | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1803 for x64-based Systems | KB4556807 | Security Update | Yes | |
| Windows Server, version 1803 (Server Core Installation) | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1803 for ARM64-based Systems | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1809 for 32-bit Systems | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1809 for x64-based Systems | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1809 for ARM64-based Systems | KB4551853 | Security Update | Yes | |
| Windows Server 2019 | KB4551853 | Security Update | Yes | |
| Windows Server 2019 (Server Core installation) | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1909 for 32-bit Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1909 for x64-based Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1909 for ARM64-based Systems | KB4556799 | Security Update | Yes | |
| Windows Server, version 1909 (Server Core installation) | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1709 for 32-bit Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1709 for x64-based Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1709 for ARM64-based Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1903 for 32-bit Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1903 for x64-based Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1903 for ARM64-based Systems | KB4556799 | Security Update | Yes | |
| Windows Server, version 1903 (Server Core installation) | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1607 for 32-bit Systems | KB4556813 | Security Update | Yes | |
| Windows 10 Version 1607 for x64-based Systems | KB4556813 | Security Update | Yes | |
| Windows Server 2016 | KB4556813 | Security Update | Yes | |
| Windows Server 2016 (Server Core installation) | KB4556813 | Security Update | Yes |
Security updates (5)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 8.8 (HIGH)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 10 1607 (x64) | all listed versions |
| windows 10 1607 (x86) | all listed versions |
| windows 10 1709 | all listed versions |
| windows 10 1803 | all listed versions |
| windows 10 1809 | all listed versions |
| windows 10 1903 | all listed versions |
| windows 10 1909 | all listed versions |
| windows server 2016 | all listed versions |
| windows server 2019 | all listed versions |
| windows server 2019 1903 | all listed versions |
| windows server 2019 1909 | all listed versions |
References
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |