CVE-2020-1529: 
vulnerability analysis and mitigation

CVE-2020-1529 is an elevation of privilege vulnerability that exists in the Windows Graphics Device Interface (GDI) due to improper handling of objects in memory. The vulnerability was discovered and reported to Microsoft, who assigned it a CVSS v3.1 base score of 7.8 (HIGH) (NVD).

The vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. It has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with low attack complexity and privilege requirements (NVD).

If successfully exploited, this vulnerability allows an attacker to run arbitrary code in kernel mode, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights. The high severity rating reflects the significant potential impact on system security (NVD).

To exploit this vulnerability, an attacker must first log on to the target system and then run a specially crafted application that could exploit the vulnerability to take control of an affected system. The local access requirement somewhat limits the exploitation potential (NVD).

Microsoft has addressed this vulnerability by releasing a security update that corrects how GDI handles objects in memory and prevents instances of unintended user-mode privilege elevation (NVD).