Loading vulnerability…
CVE-2020-1054 is a Windows local elevation-of-privilege vulnerability in the Win32k kernel-mode component caused by improper handling of objects in memory. Available reporting further characterizes the flaw as an out-of-bounds write in Win32k. Successful exploitation allows a local attacker to corrupt kernel memory and leverage the condition to elevate privileges. The vulnerability has been observed in the wild and incorporated into multiple malware and exploit-kit chains, including Purple Fox, Raspberry Robin, Roshtyak, and Underminer, primarily as a post-compromise privilege-escalation step on unpatched Windows systems.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module implementing a local privilege escalation exploit for CVE-2020-1054, an out-of-bounds write vulnerability in the Windows kernel (win32k.sys) triggered via the DrawIconEx function. The exploit targets Windows 7 x64 SP1 systems with specific win32k.sys versions. The module checks the target's win32k.sys version to determine exploitability, then injects a custom DLL payload (typically Meterpreter) to achieve SYSTEM privileges. The exploit is operational and requires a Meterpreter session on a vulnerable system. The main fingerprintable endpoints are the win32k.sys driver file and the DLL payload used for exploitation. The code is written in Ruby and is structured as a standard Metasploit local exploit module.
This repository contains a local privilege escalation exploit for Microsoft Windows, targeting CVE-2020-1054. The structure includes a Visual Studio solution and project files, an assembly shellcode file (shellcode.asm), and a reference to an external analysis in the README. The main exploit logic is implemented in 'exploit.cpp' (not shown, but referenced in the project), and the shellcode (WndProc_fake) is designed to search for the SYSTEM process in kernel memory and copy its token to the current process, thereby granting SYSTEM privileges. The exploit is operational and requires local code execution on a vulnerable Windows system. No network endpoints or remote attack vectors are present; the attack is purely local. The repository is suitable for researchers or attackers seeking to escalate privileges on affected Windows systems.
This repository contains a local privilege escalation (LPE) exploit for CVE-2020-1054, targeting Windows 7 x64 systems. The exploit is implemented in Rust (main code in src/main.rs) and leverages Windows GDI bitmap object manipulation to achieve arbitrary kernel memory write, ultimately allowing the attacker to elevate privileges to SYSTEM. The exploit works by locating and manipulating the current process token in kernel memory, then injecting and executing shellcode to spawn a SYSTEM shell. The README provides compilation and usage instructions, as well as notes about potential adjustments required for different Windows KBs. The only code file is src/main.rs, which contains the full exploit logic and embedded shellcode. No network endpoints are involved; the attack vector is purely local, requiring code execution on the target machine.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Win32k kernel local privilege escalation vulnerability used by Purple Fox to elevate privileges via publicly available exploit code.
A Win32k elevation-of-privilege vulnerability involving an out-of-bounds write, used by Raspberry Robin to elevate privileges on certain Windows 7 systems.
A Windows kernel elevation-of-privilege vulnerability that Roshtyak includes and uses as a privilege-escalation exploit on specific unpatched Windows 7 systems.
A vulnerability used by the Underminer exploit kit as part of its exploit chain targeting Chromium-based browsers, but not analyzed in detail in this content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.