CVE-2020-1560
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- microsoft
Description
A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Exploitation of the vulnerability requires that a program process a specially crafted image file. The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.
Timeline
ID reserved
By microsoft
- 10 months later
· 10 months later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microsoftCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 26% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
- Remote Code Execution
Affected products
Microsoft · Windows 10 Version 2004
- affected N/A
Microsoft · Windows Server version 2004
- affected N/A
Microsoft · Windows 10 Version 1803
- affected N/A
Microsoft · Windows 10 Version 1809
- affected N/A
Microsoft · Windows 10 Version 1909
- affected N/A
Microsoft · Windows 10 Version 1709 for 32-bit Systems
- affected N/A
Microsoft · Windows 10 Version 1709
- affected N/A
Microsoft · Windows 10 Version 1903 for 32-bit Systems
- affected N/A
Microsoft · Windows 10 Version 1903 for x64-based Systems
- affected N/A
Microsoft · Windows 10 Version 1903 for ARM64-based Systems
- affected N/A
References (1)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1560 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-1560)Record last updated .