CVE-2020-17068: 
vulnerability analysis and mitigation

Windows GDI+ Remote Code Execution Vulnerability (CVE-2020-17068) was disclosed in November 2020. This vulnerability affects various versions of Microsoft Windows, including Windows 10 (multiple versions from 1607 to 20H2), Windows 7 SP1, and Windows Embedded Compact 7 (NVD).

The vulnerability has received a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it scored 7.2 (High) with vector (AV:L/AC:L/Au:N/C:C/I:C/A:C) (NVD).

This vulnerability could allow an attacker to execute remote code on affected systems, potentially gaining the same level of privileges as the current user. The high CVSS scores indicate significant potential impact on the confidentiality, integrity, and availability of affected systems (NVD).

The vulnerability requires local access and low attack complexity to exploit. The attack requires low privileges but no user interaction to execute (NVD).

Microsoft released security updates to address this vulnerability in December 2020. For Windows Embedded Compact 7, the update requires a clean build of the whole platform after application. The update includes modified GDI+ related files and libraries (Microsoft Support).