CVE-2020-1054: Windows kernel-mode driver out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKernel-level privilege escalation with a public exploit and KEV listing, though it requires prior local logon and has high attack complexity.

What it is

The Windows kernel-mode driver mishandles objects in memory, an out-of-bounds write (CWE-787) that lets a logged-on attacker run code in kernel mode. Because the flaw sits in the kernel, success means full control of the host rather than a sandboxed compromise.

Impact

An attacker gains kernel-mode code execution, allowing installation of programs, viewing, changing or deleting data, and creation of accounts with full user rights.

Attack surface

Reached locally: the attacker must first log on to the system and then run a specially crafted application. No user interaction beyond that logon is required, and the CVSS vector (AV:L/PR:L/UI:N) confirms local, low-privilege access.

Exploitation

CVE-2020-1054 is listed in CISA KEV (added 2021-11-03) and has a high EPSS 30-day probability of 0.54158 (99th percentile); a public exploit reference exists (Packet Storm, DrawIconEx local privilege escalation). No ransomware campaign use is documented.

What to do

• Apply the Microsoft update for CVE-2020-1054 on all affected Windows client and server versions, prioritizing internet-facing and multi-user hosts.
• Restrict interactive logon and local execution rights so untrusted users cannot run arbitrary applications on sensitive systems.
• Enforce least privilege and remove unnecessary local administrator accounts to limit the value of a kernel escalation.
• Monitor for and block known exploit tooling for the DrawIconEx local privilege escalation path where feasible.

Detection

• Alert on unexpected kernel-mode driver activity or crashes consistent with memory corruption on endpoints.
• Hunt for processes spawning from unusual parent contexts shortly after interactive logon, especially on hosts with unpatched Windows builds.
• Track patch compliance for the affected Windows 10, Windows 7, Windows 8.1 and Windows Server builds and flag unpatched assets.
• Correlate local privilege escalation attempts with subsequent account creation or service installation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.