CVE-2020-1146: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1146) exists in the Microsoft Store Runtime when it improperly handles memory. The vulnerability was discovered and reported to Microsoft in November 2019, affecting various versions of Windows 10 and Windows Server 2016 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) by NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Microsoft assessed it with a score of 6.6 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. The vulnerability requires local access and low privileges to exploit (NVD).

If successfully exploited, this vulnerability allows an attacker to elevate privileges on the affected system. The attacker could gain the ability to run specially crafted applications with elevated privileges, potentially gaining full control over the affected system (CVE).

To exploit this vulnerability, an attacker would first need to gain execution capabilities on the target system. Once achieved, they could run a specially crafted application to elevate privileges (NVD).

Microsoft has released a security update that addresses the vulnerability by correcting how the Microsoft Store Runtime handles memory. Users are advised to apply the security update to affected systems (CVE).