CVE-2020-0638

State: Published
Severity: 7.8 High
Published: Jan 14, 2020
Updated: Aug 12, 2026
Reserved: Nov 4, 2019

Description

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
WindowsMicrosoft	10 Version 1709 for 32-bit SystemsAffected 10 Version 1803 for 32-bit SystemsAffected 10 Version 1809 for ARM64-based SystemsAffected 10 Version 1803 for x64-based SystemsAffected 10 Version 1709 for ARM64-based SystemsAffected 10 Version 1709 for x64-based SystemsAffected 10 Version 1803 for ARM64-based SystemsAffected 10 Version 1809 for 32-bit SystemsAffected 10 Version 1809 for x64-based SystemsAffected
Windows 10 Version 1903 for ARM64-based SystemsMicrosoft	unspecifiedAffected
Windows 10 Version 1903 for 32-bit SystemsMicrosoft	unspecifiedAffected
Windows 10 Version 1903 for x64-based SystemsMicrosoft	unspecifiedAffected
Windows ServerMicrosoft	2019Affected 2019 (Core installation)Affected version 1803 (Core Installation)Affected
Windows Server, version 1903 (Server Core installation)Microsoft	unspecifiedAffected
Windows 10 Version 1909 for 32-bit SystemsMicrosoft	unspecifiedAffected
Windows 10 Version 1909 for x64-based SystemsMicrosoft	unspecifiedAffected
Windows Server, version 1909 (Server Core installation)Microsoft	unspecifiedAffected
Windows 10 Version 1909 for ARM64-based SystemsMicrosoft	unspecifiedAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.