CVE-2020-1512: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1512) exists in the Windows State Repository Service when it improperly handles objects in memory. The vulnerability was identified and reported to Microsoft, who later released a security update to address the issue. The vulnerability affects various versions of Windows 10 and Windows Server 2016 (NVD).

The vulnerability stems from improper memory object handling in the Windows State Repository Service. It has been assigned a CVSS 3.1 base score of 5.5 (Medium) by NIST and 7.8 (High) by Microsoft. The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required and user interaction is needed (NVD).

If successfully exploited, this vulnerability could allow an attacker to obtain sensitive information that could be used to further compromise the affected system. The impact is primarily focused on information disclosure, with no direct impact on system integrity or availability (NVD).

The vulnerability can be exploited by running a specially crafted application on the victim system. The attack requires local access and user interaction, making it somewhat more difficult to exploit in practice (NVD).

Microsoft has addressed this vulnerability by correcting the way the Windows State Repository Service handles objects in memory. Users are advised to apply the security update provided by Microsoft to mitigate this vulnerability (Microsoft Advisory).