CVE-2020-1118: Microsoft Windows 10

High severity, CVSS 8.6. EPSS: 15% chance of exploitation in the next 30 days.

A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, a remote unauthenticated attacker could send a specially crafted request to a target system utilizing TLS 1.2 or lower, triggering the system to automatically reboot. The update addresses the vulnerability by changing the way TLS key exchange messages are validated.

Affected products

• Microsoft Windows 10: version 1709 only; version 1803 only; version 1809 only; version 1903 only; version 1909 only
• Microsoft Windows Server 2019: affected versions not specified; version 1903 only; version 1909 only

Published 2020-05-21. Last modified 2026-08-19.