---
id: CVE-2020-1066
title: >-
  An elevation of privilege vulnerability exists in .NET Framework which could
  allow an attacker to elevate their privilege level.

  To exploit the vulnerability, an attacker would first have to access the local
  machine, and then run a malic…
summary: >-
  An elevation of privilege vulnerability exists in .NET Framework which could
  allow an attacker to elevate their privilege level.

  To exploit the vulnerability, an attacker would first have to access the local
  machine, and then run a malic…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: microsoft
product: .net_framework
affected:
  - .net_framework = 3.0
  - .net_framework = 3.5.1
published: '2020-05-21'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-1066'
references:
  - url: 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1066'
    label: secure@microsoft.com
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1066
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.02501
epssPercentile: 0.84021
ingestedAt: '2026-08-19T17:42:36.861Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/cbwang505/CVE-2020-1066-EXP'
    - 'https://github.com/xyddnljydd/cve-2020-1066'
  checkedAt: '2026-09-25T08:20:37.184Z'
exploitAvailable: true
---

## Overview

An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.
To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.
The update addresses the vulnerability by correcting how .NET Framework activates COM objects.

## Affected

- `.net_framework = 3.0`
- `.net_framework = 3.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.