CVE-2020-1435: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1435) was identified in the Windows Graphics Device Interface (GDI) related to how it handles objects in memory. The vulnerability was disclosed on July 14, 2020, affecting various versions of Microsoft Windows including Windows 10 and Windows 7 SP1 (NVD).

The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required. Under CVSS v2.0, it scored 9.3 (HIGH) with the vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

This vulnerability could allow remote code execution if successfully exploited, potentially giving attackers the ability to execute arbitrary code with high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability requires user interaction for successful exploitation, as indicated by the CVSS vector string. The victim must voluntarily interact with the attack mechanism for the exploit to be successful (NVD).

Microsoft released security updates to address this vulnerability as part of their July 2020 Patch Tuesday updates. The fix was included among patches for 123 security holes in Windows and related software (Krebs Security).