Microsoft Windows Codecs Library Remote Code Execution Vulnerability

Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory [1]. The specific flaw resides in the parsing of WebM videos: crafted data in a WebM video can trigger access to a pointer prior to initialization [1]. This affects all supported versions of Microsoft Windows prior to the September 2020 security update [1].

Exploitation

An attacker who wants to exploit this vulnerability does not need any form of authentication or special network position. However, user interaction is required: the target must either visit a malicious webpage or open a specially crafted image or video file [1]. Once the user performs this action, the application relying on the Windows Codecs Library will parse the malicious content, causing the uninitialized pointer dereference.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process, which in some scenarios runs with the privileges of the logged-on user. This could enable the attacker to install programs, view/change/delete data, or create new accounts with full user rights [1]. The CVSS score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Mitigation

Microsoft released a security update on September 8, 2020 that corrects how the Windows Codecs Library handles objects in memory [1]. All users are strongly recommended to apply the latest cumulative update for their Windows version. No workarounds were published, and there is no indication the vulnerability was listed on the KEV catalog at the time of this writing.