CVE-2020-1122: Windows Language Pack Installer Elevation of Privilege Vulnerability

Overview

Severity

Medium (CVSS 5.5)

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2020-Sep

Released

2020-09-08

EPSS Score

0.44% (percentile: 63.0%)

Description

An elevation of privilege vulnerability exists when the Windows Language Pack Installer improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way the Windows Language Pack Installer handles file operations.

Affected Products (20)

Other

• 11497
• 11498
• 11563
• 11568
• 11569
• 11570
• 11571
• 11572
• 11712
• 11713
• 11714
• 11715
• 11644
• 11645
• 11646
• 11647
• 11766
• 11767
• 11768
• 11769

Security Updates (4)

• 4577032
• 4570333
• 4574727
• 4571756

Acknowledgments

Xuefeng Li (@lxf02942370)

Revision History

• 2020-09-08: Information published.