|CVSS SCORE||2.5, (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)|
This vulnerability allows local attackers to disclose information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the user-mode printer driver host process splwow64.exe. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to disclose information from low integrity in the context of the current user at medium integrity.
This vulnerability is being disclosed publicly without a patch in accordance with ZDI policies.
12/27/19 – ZDI sent the vulnerability report to the vendor, the vendor provided a case ID and requested additional evidence
|CREDIT||Lucas Leong (@_wmliang_) of Trend Micro's Zero Day Initiative