^{CVE-2020-0965:}Microsoft Windows Codecs Library Remote Code Execution Vulnerability (CVE-2020-0965)

Overview

CVE-2020-0965 is a critical vulnerability in the Microsoft Windows Codecs Library that could allow remote code execution. The vulnerability stems from the way the library handles objects in memory, which could be exploited by an attacker to execute malicious code. To exploit this vulnerability, an attacker would typically need to convince a user to open a specially crafted file or content that is designed to exploit the vulnerability. This could be achieved through social engineering tactics such as sending malicious email attachments or hosting malicious content on websites. The vulnerability affects various versions of Windows operating systems that use the affected Codecs Library component.

Remediation

To address this vulnerability, Microsoft has released security updates. Users and administrators should apply the appropriate security updates as soon as possible:

1. Install the latest security updates from Microsoft by using Windows Update or Microsoft Update.
2. Ensure that automatic updates are enabled to receive future security patches automatically.
3. If you cannot apply the updates immediately, consider implementing workarounds such as:
   • Restricting access to the affected Codecs Library
   • Implementing additional access controls to limit user privileges
   • Using application control policies to prevent unknown or untrusted processes from executing
4. Monitor Microsoft security advisories for any additional information or updated guidance related to this vulnerability.

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0965
2. Microsoft Security Response Center: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0965
3. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2020-0965
4. Microsoft Windows Codecs Library documentation: https://docs.microsoft.com/en-us/windows/win32/medfound/codec-objects