CVE-2020-1002
HighCVSS 7.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
An elevation of privilege vulnerability exists when MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system.
Risk Assessment
A logged-on local attacker could delete files in arbitrary locations, potentially destabilizing the system or bypassing security mechanisms.
Recommendation
Install the Microsoft Defender update containing the fix and restrict local logon to necessary accounts.
Other vulnerabilities in Microsoft Defender
See all- CVE-2026-45498MediumActively exploited
Microsoft Defender Denial of Service Vulnerability.
- CVE-2026-41091HighActively exploited
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2026-33825HighActively exploited
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2021-42298High
Remote code execution vulnerability in Microsoft Defender. An attacker could exploit this vulnerability to execute arbitrary code on the system.
- CVE-2021-1647HighActively exploited
Microsoft Defender contains a remote code execution vulnerability. Details of the vulnerability are not provided in the description.
- CVE-2026-70264Medium
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.
- CVE-2026-105726Medium
Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally. The flaw results from reading data beyond the intended memory boundary.
- CVE-2026-50658High
A Time-of-check time-of-use (TOCTOU) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2026-50657Medium
In Microsoft Defender, exposure of private personal information to an unauthorized actor allows an authorized attacker to disclose information locally.
- CVE-2026-55012High
An integer overflow or wraparound vulnerability has been discovered in Microsoft Defender. This flaw allows an unauthorized attacker to execute code locally.
Original NVD description (English source)
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS