CVE-2020-1048

Vulnerability

The Windows Print Spooler service (spoolsv.exe) contains an elevation of privilege vulnerability due to improper enforcement of file write permissions. An attacker can exploit this to write arbitrary files to the file system, including to locations normally restricted to higher-integrity processes. This affects all supported versions of Windows at the time of disclosure (May 2020). The vulnerability is distinct from CVE-2020-1070.

Exploitation

An attacker must already have local access to the system with limited user privileges. No user interaction is required beyond the attacker's own actions. The attacker can trigger the Print Spooler to write a specially crafted file (e.g., a malicious DLL) to a system directory, such as C:\Windows\System32\, by sending a crafted print job or manipulating spooler operations.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the SYSTEM account, gaining complete control over the affected system. This includes the ability to install programs, view/change/delete data, and create new accounts with full user rights.

Mitigation

Microsoft released a security update as part of the May 2020 Patch Tuesday (KB4556799 for Windows 10, version 1909, and corresponding updates for other versions). Users should apply the latest Windows updates. No workaround is available; the only mitigation is to install the patch. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.