Description
<p>A remote code execution vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p> <p>To exploit the vulnerability, a user would have to open a specially crafted file or lure the target to a website hosting malicious JavaScript.</p> <p>The security update addresses the vulnerability by correcting how Microsoft COM for Windows handles objects in memory.</p>
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
E
Physical
RL
O
RC
Changed
Affected products
- Microsoft / Windows 101903 – 1903
- Microsoft / Windows 101709 – 1709
- Microsoft / windows_10_1507
- Microsoft / windows_10_1507
- Microsoft / windows_10_1607
- Microsoft / windows_10_1607
- Microsoft / windows_10_1803
- Microsoft / windows_10_1803
- Microsoft / windows_10_1809
- Microsoft / windows_10_1809
- Microsoft / windows_10_1809
- Microsoft / windows_10_1909
- Microsoft / windows_10_1909
- Microsoft / Windows 7
- Microsoft / Windows 7
- Microsoft / Windows 8.1
- Microsoft / Windows 8.1
- Microsoft / windows_rt_8.1
- Microsoft / windows_server_1903
- Microsoft / windows_server_1909
- Microsoft / windows_server_2004
- Microsoft / windows_server_2008_R2
- Microsoft / windows_server_2008_sp2
- Microsoft / windows_server_2008_sp2
- Microsoft / Windows Server 2012
- Microsoft / Windows Server 2012 R2
- Microsoft / Windows Server 2016
- Microsoft / Windows Server 2019