{"uuid": "bdfabde3-5f13-4e68-a4ee-50143bd2cdd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0986", "type": "seen", "source": "https://t.me/cissp/1298", "content": "CVE-2020-0986\nCVE-2020-0986 is an arbitrary pointer dereference vulnerability in GDI Print/Print Spooler API. By using this vulnerability it is possible to manipulate the memory of the splwow64.exe process to achieve execution of arbitrary code in the process and escape the Internet Explorer 11 sandbox because splwow64.exe is running with medium integrity level. \u201cPrint driver host for applications,\u201d as Microsoft describes splwow64.exe, is a relatively small binary that hosts 64-bit user-mode printer drivers and implements the Local Procedure Call (LPC) server that can be used by other processes to access printing functions\nhttps://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/", "creation_timestamp": "2026-09-01T17:01:12.901275Z"}