CVE-2020-1117: 
vulnerability analysis and mitigation

A remote code execution vulnerability exists in Microsoft's Color Management Module (ICM32.dll) related to how it handles objects in memory. This vulnerability, identified as CVE-2020-1117, was disclosed and patched as part of Microsoft's May 2020 Patch Tuesday updates (Krebs Security).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 9.3 (HIGH) with vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute remote code on the affected system, potentially gaining the same user rights as the current user. The high CVSS scores indicate severe potential impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability requires user interaction for successful exploitation, as indicated by the CVSS vector (UI:R). The attack can be initiated remotely (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) (NVD).

Microsoft has released security patches to address this vulnerability as part of their May 2020 Patch Tuesday updates. Users and administrators should apply the security updates provided through the Microsoft Security Response Center (MSRC).