CVE-2020-1027

CVE-2020-1027 is a local elevation-of-privilege vulnerability in the Windows kernel caused by an out-of-bounds write (CWE-787) in how the kernel handles objects in memory; the referenced public proof of concept characterizes the flaw as a heap buffer overflow in the Windows sxs component's XML parsing of assembly manifest ('assemblyIdentity') data. An attacker with low privileges on a targeted system can trigger the memory corruption without user interaction, typically by causing crafted assembly/manifest content to be parsed. Successful exploitation elevates the attacker to kernel privileges, giving full control of the host with high confidentiality, integrity, and availability impact. All Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 1909, and Windows Server 1803 and 1903 installations were in scope when the flaw was disclosed. The bug was actively exploited at the time it was patched: April 2020 Patch Tuesday reporting describes it among three Windows issues exploited in the wild, Google Project Zero tied it to a sophisticated hacking campaign that used 11 zero-days, CISA added it to the KEV catalog on 2022-05-23, and EPSS currently estimates a 4.5% probability of exploitation within 30 days.

What to do: Apply the April 2020 Windows security updates (or any later cumulative update) to every affected Windows 7, 8.1, RT 8.1, Windows 10 1507-1909, and Windows Server 1803/1903 system, per vendor instructions; CISA's KEV listing makes patching this CVE mandatory for federal agencies. Because exploitation requires local code execution, prioritize multi-user and internet-exposed hosts such as RDS/session servers, VDI, and jump hosts, and anywhere unprivileged users can run untrusted code. Most affected versions are now past end of support, so any system that cannot receive the patch should be migrated to a supported Windows release, and remediation should be verified by confirming the April 2020 or later cumulative update is installed on each host.