CVE-2020-1091: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1091) exists in the Windows GDI (Graphics Device Interface) component when it improperly discloses the contents of its memory. The vulnerability was discovered and reported to Microsoft in November 2019, affecting various versions of Windows 10, Windows 7 SP1, and related systems (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability only affects confidentiality, with no impact on integrity or availability (NVD).

If successfully exploited, an attacker could obtain sensitive information from the system's memory, which could be used to further compromise the user's system. The vulnerability specifically affects the Windows GDI component's handling of memory contents (CVE).

The vulnerability can be exploited through multiple attack vectors. An attacker could convince a user to either open a specially crafted document or visit an untrusted webpage to trigger the vulnerability (NVD).

Microsoft has addressed this vulnerability by releasing a security update that corrects how the Windows GDI component handles objects in memory. Users are advised to apply the available patches through the Microsoft security advisory (Microsoft Advisory).