CVE-2020-17110
📋 TL;DR
CVE-2020-17110 is a remote code execution vulnerability in Microsoft's HEVC Video Extensions that allows attackers to execute arbitrary code by tricking users into opening specially crafted media files. This affects Windows systems with the HEVC Video Extensions installed, potentially allowing attackers to gain control of affected systems.
💻 Affected Systems
- Microsoft HEVC Video Extensions
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining SYSTEM-level privileges, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Attacker gains user-level privileges on the compromised system, enabling data access, credential theft, and lateral movement within the network.
If Mitigated
Limited impact with proper application whitelisting, restricted user privileges, and network segmentation preventing lateral movement.
🎯 Exploit Status
Requires user interaction to open malicious media file. No public exploit code available as of last analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: HEVC Video Extensions version 1.0.32763.0 or later
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17110
Restart Required: No
Instructions:
1. Open Microsoft Store. 2. Search for 'HEVC Video Extensions'. 3. Click 'Get Updates' or install the latest version. 4. Alternatively, update through Windows Update if configured to receive Store app updates.
🔧 Temporary Workarounds
Uninstall HEVC Video Extensions
windowsRemove the vulnerable component entirely if not required for business operations
Get-AppxPackage *HEVC* | Remove-AppxPackage
Disable automatic codec installation
windowsPrevent automatic installation of media codecs that could be vulnerable
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Media Foundation' -Name 'DisableMediaFoundationCodecDownload' -Value 1
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of HEVC Video Extensions
- Restrict user privileges to standard user accounts to limit impact of successful exploitation
🔍 How to Verify
Check if Vulnerable:
Check HEVC Video Extensions version in Microsoft Store or via PowerShell: Get-AppxPackage *HEVC* | Select Name, VersionCheck Version:
Get-AppxPackage *HEVC* | Select-Object -ExpandProperty VersionVerify Fix Applied:
Verify version is 1.0.32763.0 or higher: Get-AppxPackage *HEVC* | Where {$_.Version -ge '1.0.32763.0'}📡 Detection & Monitoring
Log Indicators:
- Windows Application logs showing HEVC Video Extensions crashes
- Process creation events for unexpected processes after media file access
Network Indicators:
- Outbound connections from systems after media file processing
- DNS requests to suspicious domains following media file access
SIEM Query:
EventID=1000 AND Source='Application Error' AND (ProcessName LIKE '%HEVC%' OR FaultingModule LIKE '%HEVC%')