CVE-2020-1064: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1064) exists in the MSHTML engine due to improper input validation. This vulnerability was discovered and reported to Microsoft in November 2019, affecting various versions of Internet Explorer and Windows operating systems (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 7.6 with the vector (AV:N/AC:H/Au:N/C:C/I:C/A:C). The vulnerability requires user interaction and has network attack vector capabilities (NVD).

If successfully exploited, an attacker could execute arbitrary code in the context of the current user. This means the attacker could potentially gain the same rights and access as the compromised user, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights (CVE).

The vulnerability requires high attack complexity and user interaction for successful exploitation. An attacker would need to convince a user to visit a specially crafted website or open a malicious file to trigger the vulnerability (NVD).

Microsoft has released security patches to address this vulnerability. Users should apply the security updates through Windows Update or download and install them manually from the Microsoft Security Update Guide (Microsoft MSRC).

The vulnerability was included in Microsoft's May 2020 Patch Tuesday release, which addressed a total of 111 vulnerabilities, with this being one of the 15 critical vulnerabilities fixed in that update (Talos).