CASCACascade Atlas

Evidence dossier

CVE-2020-1054

Win32k Elevation of Privilege Vulnerability

Exploited in the wild (CISA KEV since Nov 3, 2021). secure@microsoft.com reports CVSS 3.1 7.0. EPSS estimates 53.9% exploit likelihood as of Oct 21, 2026.

72.2–88.1Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

State
PUBLISHED
Published
May 21, 2020
Updated
Oct 7, 2026
Evidence coverage
85%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Microsoft Win32k Privilege Escalation Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Microsoft Win32k Privilege Escalation Vulnerability
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateSource date omittedFirst observed by CASCA
    microsoft

    Record text: Win32k Elevation of Privilege Vulnerability

    Inspect raw assertion
    Field
    container
    Value
    Win32k Elevation of Privilege Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 53.88% probability · 99th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.538780000000; percentile 0.990000000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Nov 3, 2021 · first observed Sep 1, 2026

Exploit likelihood53.88%

FIRST EPSS · score date Oct 21, 2026 · 99th percentile · first observed Oct 21, 2026

SeverityCVSS 7.0

secure@microsoft.com · CVSS 3.1 · first observed Oct 8, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusLast verified source snapshot retained

The last verified source boundary remains in force for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
Review source contract
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Oct 22, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Oct 22, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA KEVOriginal assertion
Exploitation cataloged

Microsoft Win32k Privilege Escalation Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Microsoft Win32k Privilege Escalation Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
microsoftOriginal assertion
Record text

Win32k Elevation of Privilege Vulnerability

Inspect raw assertion
Field
container
Value
Win32k Elevation of Privilege Vulnerability
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

53.88% probability · 99th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.538780000000; percentile 0.990000000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
32Underlying assertions
17Canonical products
32Target assertions
0Constraint assertions

Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

46 scope groups

microsoft · source assertedMicrosoftWindows 10 Version 1507Direct source scope
Affected: 10.0.10240.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.10240.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1607Direct source scope
Affected: 10.0.14393.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.14393.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1709Direct source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1709 for 32-bit SystemsDirect source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1803Direct source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1809Direct source scope
Affected: 10.0.17763.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.17763.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1809Direct source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1903 for 32-bit SystemsDirect source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1903 for ARM64-based SystemsDirect source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1903 for x64-based SystemsDirect source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 10 Version 1909Direct source scope
Affected: 10.0.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 7Direct source scope
Affected: 6.1.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.1.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 7 Service Pack 1Direct source scope
Affected: 6.1.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.1.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows 8.1Direct source scope
Affected: 6.3.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.3.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2008 R2 Service Pack 1Direct source scope
Affected: 6.1.7601.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.1.7601.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)Direct source scope
Affected: 6.1.7601.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.1.7601.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2008 Service Pack 2Direct source scope
Affected: 6.0.6003.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.0.6003.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)Direct source scope
Affected: 6.0.6003.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.0.6003.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2012Direct source scope
Affected: 6.2.9200.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.2.9200.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2012 R2Direct source scope
Affected: 6.3.9600.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.3.9600.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2012 R2 (Server Core installation)Direct source scope
Affected: 6.3.9600.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.3.9600.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2012 (Server Core installation)Direct source scope
Affected: 6.2.9200.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.2.9200.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2016Direct source scope
Affected: 10.0.14393.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.14393.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2016 (Server Core installation)Direct source scope
Affected: 10.0.14393.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.14393.0", "lessThan": "publication", "versionType": "custom"}]
microsoft · source assertedMicrosoftWindows Server 2019Direct source scope
Affected: 10.0.17763.0 to before publication (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.17763.0", "lessThan": "publication", "versionType": "custom"}]

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 2 source-reported links

Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
29
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
16b8e997-3dfa-434c-b381-02e18b25f51e241c69f8-7fa0-4a12-82f1-5f62fa0d08c831a67c2a-291d-4a79-8e7e-c03d0ebc1ee245390858-a13d-4288-ba49-f6c756709bc74dbcfe21-5f36-4c4d-a429-fce4172ff2c84de9ad76-c09d-42ef-a19c-48e3ddca82204f5d65f3-e2ef-4572-8807-3ab0b44f1a3a5b31204c-7be9-41d7-ad88-e70818d8e77163a477b8-4598-476d-9669-fe82f233c9f6661c9543-59e7-4fb9-8fb1-267de8474254744b0dee-7ae2-4aa6-aa3b-3709e437646b79d72be7-80ca-4a58-bbd2-29eb40d5f2cb7ccfb6e1-664b-450a-8cdb-e76d0527a9a87ea3b7ef-95ff-4744-a843-aa32cf58199085a049a0-7805-467b-a4dd-6088c7f94bbd8e39a7c0-6fc0-4169-908c-f1c329321c6a93765a2f-8a4d-4eb6-8d74-07e6421af3889d7c6dd1-d713-4ca7-be39-828065882135a1496bdf-cf8a-4ba3-a4ce-e947d9a17473a94c1eb0-2ed9-46b4-a43f-eb72ef4f0b75b14a780e-cc96-472d-a03f-89ca2845e699bd69c39d-927f-4e27-9aca-9c316ba2b686bdf10b17-eba2-4559-ae1d-5b05815a8ee1c5a7b98b-2f8b-45da-b61a-7442afa47f0ccad79a6d-5a9c-4ed7-907a-0358755b0636df7f8ac1-827b-41af-857c-bb43fdf71377ef8fe32a-3107-40c1-9587-04b8958746d6faf48e81-7165-43c7-9ba6-2c7d893d278ffe589029-baa2-4fae-8993-c032410e535a
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Nvd cpe vulnerable target
Assertions
32
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
0fdf57ab-9f82-454b-bc1a-8b89554f20b118233384-f141-4ac0-87d2-fb534f36aa2c18af4ef4-cd2b-4e88-9bf6-289b3827d80f251a15bf-0a6b-45e2-8a00-fb39c5991a532a843849-c9bf-4193-b087-dd4f659299142f39f78d-be5c-4be0-831b-e295dc515b5f3c97262c-0dd7-4e6e-90ae-236b1e5d1a2541985924-b7ed-4cc1-a9a9-748c160b35af436c6e9f-3aec-41f7-9ee4-617ef7b49d694b6aa4f2-27dd-4458-b2d7-1550cfe705c564fb6d63-09d0-4209-845f-751aa940b76373185ab8-8bc0-4910-b454-dfca8c06dd987627b8e1-7728-4891-af92-55bfd70de20e7b9a4eda-780a-4cc3-b3a1-697f5346909c8b829a02-41d7-4e24-9096-25326e89bbac92c20972-6d27-43ed-be71-47314e8daf1799b53957-a548-44d1-87a2-fb70de7cd2fb9d149ba6-63fb-4e74-9dd8-d69b9bd0acc69ff2c52a-4a8c-4e6c-abda-fd453e4d5956a3d290c7-29ac-4dce-bba5-e6bea4989e98b7e52f25-84c2-4bc5-9bde-4b07f5a1aaf8bc7965db-1061-4179-9f87-491bc5d390a6bebcf272-0ab8-4e93-97c9-6b8bdb6888c6c36af7e1-f483-4f0a-8ff1-bf0e80b2836dc9a22d5c-9f41-46a5-a858-d747e366af10cb3107c8-6d36-4399-ba54-a2be96e50587d908b4ba-59fb-4e00-8b15-1cfecea12c02ed28b5a0-5150-4715-8ac3-a9eafb86f863ef9ab4b5-9766-4e13-b9d0-947b42d3559fef9bc8a7-a940-48a6-ab9e-d71e12134aa9efec27f9-bcf1-42d4-b052-6ff9e842266af5fd2ebe-6865-4fda-aaa2-191aa72aceab

Assessments

CVSS by origin

7.0
secure@microsoft.comCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:L/AC:L/Au:N/C:C/I:C/A:C
7.8
NVDCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.0
microsoftCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Direct CVE/CNA normalized decisions

7.0Priority eligible

microsoft

CVSS 3.1 · Primary · Original assertion · rank 1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Validation
Valid match
Recomputed
7.0
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.