CVE-2020-1239: 
vulnerability analysis and mitigation

A memory corruption vulnerability (CVE-2020-1239) was discovered in Windows Media Foundation, specifically within the mpg2splt.ax module. The vulnerability was reported on March 5, 2020, and Microsoft released a patch on June 9, 2020. This vulnerability affects Microsoft Windows Media Player installations (ZDI Advisory).

The vulnerability exists due to improper handling of objects in memory within the Windows Media Foundation component. The specific flaw resides in the mpg2splt.ax module and stems from inadequate validation of user-supplied data, which can result in an integer underflow before reading from memory. The vulnerability has been assigned a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Microsoft Windows Media Player. The high CVSS score of 8.8 indicates severe potential consequences including complete compromise of system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation, specifically the target must visit a malicious page or open a malicious file. This requirement somewhat mitigates the risk of widespread automated attacks (ZDI Advisory).

Microsoft has released a security update to address this vulnerability. Users are strongly advised to apply the available patches through Windows Update. The fix was released as part of Microsoft's June 2020 Patch Tuesday updates (Rapid7 Blog).