CVE-2020-0986

What is splwow64 and Why Does It Matter Here?

splwow64.exe is a Windows helper process that bridges 32-bit printing API calls to the 64-bit print spooler subsystem. It's an obscure piece of plumbing most users never think about — exactly the kind of legacy compatibility component that quietly accumulates unreviewed attack surface over years, and a favorite target for researchers and attackers looking for local privilege-escalation primitives.

Overview

CVE-2020-0986 is a privilege-escalation vulnerability in the Windows GDI print spooler API exposed via splwow64, arising from an arbitrary pointer dereference that lets a local attacker escalate to elevated privileges (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Kaspersky's Global Research and Analysis Team (GReAT) discovered it being actively exploited in the wild in May 2020 as the privilege-escalation half of "Operation PowerFall," a two-stage exploit chain that also used an Internet Explorer scripting engine 0-day, CVE-2020-1380 (also enriched on this site), for initial code execution. Kaspersky reported it to Microsoft as an unpatched 0-day; Microsoft's fix followed roughly three weeks later in June 2020 Patch Tuesday.

Technical Details

The vulnerable code accepts a pointer value from a caller without adequately validating it before dereferencing it, allowing a local, low-privileged attacker to manipulate kernel memory in ways that escalate their privileges. In the observed real-world chain, this bug was reached only after an attacker had already achieved initial code execution via the paired IE vulnerability — this CVE's role was purely to break out of that initial foothold's limited privilege level.

Discovery

Discovered by Kaspersky's GReAT team, who identified it being exploited in the wild as part of Operation PowerFall's targeted watering-hole campaign against South Korean users and reported it to Microsoft ahead of the June 2020 patch.

Exploitation Context

Operation PowerFall represents a complete, documented two-stage exploitation chain: CVE-2020-1380 for initial code execution via a compromised website, and this CVE for privilege escalation to full system control — the same architecture seen in numerous other browser-plus-kernel exploit chains from this era. Because Kaspersky reported active exploitation roughly three weeks before Microsoft's fix shipped, this vulnerability was a genuine 0-day at the time of discovery.

Remediation

1. Apply Microsoft's June 2020 Patch Tuesday update immediately if not already installed.
2. Patch the browser alongside the OS — see CVE-2020-1380 for the initial-access half of this documented exploit chain; both need to be closed to fully mitigate Operation PowerFall-style attacks.
3. Deploy endpoint detection capable of identifying anomalous print-spooler-related process behavior, given this bug's confirmed use in a real-world targeted campaign.
4. Be alert to watering-hole attacks delivered via compromised legitimate websites, which was Operation PowerFall's initial delivery mechanism rather than a phishing email.