CVE-2020-0986: Windows Kernel Out-of-Bounds Write Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel elevation of privilege with a CVSS of 7.8, is listed in CISA KEV as exploited in the wild, and affects many widely deployed Windows versions.

What it is

The Windows kernel fails to properly handle objects in memory, resulting in an out-of-bounds write (CWE-787). A local attacker who can run code on a vulnerable system can exploit this to elevate privileges. It affects a broad set of Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server releases.

Impact

An attacker gains elevation of privilege, potentially reaching kernel-level execution and full control of the affected host. This can lead to data compromise, persistence, and further lateral movement.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution on the target. It is not remotely reachable and requires no victim action.

Exploitation

CVE-2020-0986 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.15932 (96.7th percentile), and a public Packet Storm advisory exists, though no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2020-0986 on all affected Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server versions.
• Prioritize patching systems where low-privileged local code execution is possible, such as multi-user or remote-access hosts.
• Enforce least privilege and remove unnecessary local accounts or interactive access to reduce the preconditions for exploitation.
• Monitor for and restrict untrusted binaries or scripts that could be used to trigger the kernel flaw.

Detection

• Monitor for unexpected privilege escalation events, such as processes gaining SYSTEM or kernel-level tokens without a legitimate parent process.
• Alert on suspicious local process creation chains that precede privilege changes, especially from low-integrity or user-writable locations.
• Track Windows kernel crash or memory corruption indicators (e.g., bugcheck events) that may correlate with exploitation attempts.
• Review endpoint telemetry for known exploit tooling or PoC behavior tied to the Windows kernel and splWOW64.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.