CVE-2020-1149: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1149) was discovered in the Windows Runtime, which was disclosed on May 21, 2020. The vulnerability affects multiple versions of Microsoft Windows, including Windows 10 (all versions up to 1909), Windows 7 SP1, and Windows 8.1. The issue stems from improper handling of objects in memory in the Windows Runtime component (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability requires user interaction to be exploited, as indicated by the UI:R parameter in the CVSS v3.1 vector (NVD).

If successfully exploited, this vulnerability could allow an attacker to gain elevated privileges on affected systems. The high confidentiality, integrity, and availability impact ratings (C:H/I:H/A:H) indicate that successful exploitation could result in complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and no privileges required (PR:N), but does need user interaction (UI:R) for successful exploitation (NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the appropriate patches through Windows Update or Microsoft's security advisory (MSRC Advisory).