CVE-2020-1074: Windows Jet Database Engine memory handling remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.8 with no privileges required and high EPSS, but exploitation requires user interaction and no KEV or public exploit is confirmed.

What it is

The Windows Jet Database Engine improperly handles objects in memory, allowing an attacker to execute arbitrary code when a crafted file is opened. The flaw affects a broad set of Windows client and server releases, so any system with the Jet engine reachable through file parsing is exposed. Microsoft addressed it with a memory-handling fix.

Impact

Successful exploitation gives the attacker arbitrary code execution on the victim system, typically at the privilege level of the user who opened the file. That can lead to full compromise of confidentiality, integrity and availability of that host.

Attack surface

Reached locally by enticing a victim to open a specially crafted file, per the CVSS vector AV:L/UI:R with no privileges required. No remote network vector and no authentication are needed, but user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at roughly 0.51 probability (98.9th percentile), and the only references are Microsoft patch advisories, so no public exploit code is confirmed by this record.

What to do

• Apply the Microsoft security update for CVE-2020-1074 on all affected Windows versions, prioritizing servers and widely used workstations.
• Restrict opening of untrusted Jet/Access database files and enforce email and web download filtering for such attachments.
• Run users with least privilege so code execution does not immediately yield administrative rights.
• Enable attack surface reduction and endpoint protection rules that block Office and script child processes spawning from document handlers.

Detection

• Monitor for unexpected processes spawning from applications that parse Jet/Access database files, especially Office and file preview handlers.
• Alert on Jet database engine DLLs (for example msjet40.dll) loading into unusual processes or from non-standard paths.
• Hunt for crafted database files delivered via email attachments or downloads followed by immediate process creation on the same host.
• Correlate endpoint telemetry for crashes or memory corruption in Jet engine components with subsequent suspicious child processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.