A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.
\nThere are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage.
\nThe security update addresses the vulnerability by correcting how Windows Media Audio Decoder handles objects.
","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6},"cwes":[],"references":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1593","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1593"],"products":["microsoft:windows_10","microsoft:windows_7","microsoft:windows_8.1","microsoft:windows_rt_8.1","microsoft:windows_server_2008","microsoft:windows_server_2012","microsoft:windows_server_2016","microsoft:windows_server_2019"],"source":"nvd","synced_at":"2026-10-19T21:09:20.498348299+00:00"},"epss":{"cve":"CVE-2020-1593","score":0.0282,"percentile":0.86571,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}