CVE-2020-16935: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-16935) was identified in Windows systems related to improper handling of COM object creation. The vulnerability was disclosed and assigned on August 4, 2020, affecting various versions of Microsoft Windows operating systems including Windows 10 and Windows 7 SP1 (CVE MITRE).

The vulnerability stems from Windows' improper handling of COM object creation. It has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a Base Score of 7.2 (HIGH) with the vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability allows an attacker to run arbitrary code with elevated privileges, potentially taking control of the affected system. The high severity scores across both CVSS versions indicate significant potential impact on system confidentiality, integrity, and availability (NVD).

To exploit this vulnerability, an attacker must first have the ability to log into the target system. Once logged in, they could execute a specially crafted application to exploit the vulnerability and take control of the affected system (CVE MITRE).

Microsoft has addressed this vulnerability by correcting how the Windows COM Server creates COM objects. Users are advised to apply the security update provided through the official Microsoft security advisory (Microsoft Advisory).