Back to board Open MSRC
MSRC compact vulnerability detail

CVE-2020-17022 · Microsoft Windows Codecs Library Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code. Exploitation of the vulnerability requires that a program process a specially crafted image file. The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.

Severity
n/a
Impact
n/a
CVSS
n/a base · n/a temporal
Release
2020-10-15
Signals
Microsoft Windows Codecs Library Unknown impact Exploited: No Publicly disclosed: No Exploitability: n/a
CWE
No CWE data published.
Patch Diff
Loading module diff metadata...
Resolved binary override
Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.
Old version New version
Description
A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code. Exploitation of the vulnerability requires that a program process a specially crafted image file. The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.
FAQ / Articles
FAQ
How does a user know if the update has been installed? You can check the version of the installed package. For example, click on Settings, Apps & Features, and select HEVC, Advanced Options. You will see the version there. The secure versions are 1.0.32762.0, 1.0.32763.0, and later.
FAQ
Is Windows vulnerable in the default configuration? No. Only customers who have installed the optional HEVC or "HEVC from Device Manufacturer" media codecs from Microsoft Store may be vulnerable. How do I get the updated Windows Media Codec? Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update. Alternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here. Why are these security updates offered to affected clients via the Microsoft Store and not Windows Update? These updates are for optional apps/components that are offered to customers as a download via the Microsoft Store. Updates for optional store apps/components are provided via the Microsoft Store. My server is in a disconnected environment, is it vulnerable? HEVC is not available for offline distribution and not supported on Windows Server. Users should not have it installed in these environments. Enterprise customers using Store for Business will receive the update in the same manner as consumer Store. Why are these updates bein...