Since the attack vectors are non-public, Microsoft is being a bit coy about the specifics. Based on Microsoft's vulnerability descriptions, CVE-2020-1425 and CVE-2020-1457 serve different functions, and they're probably both needed for a successful hack. CVE-2020-1425 can be used to obtain data about the system's memory configuration, and CVE-2020-1457 can most likely use that data to evade ASLR and execute the payload successfully. This would be a valuable vector to shadowy internet figures, but whoever discovered it did the right thing by disclosing it to Microsoft.
These vulnerabilities could be particularly dangerous because many different programs like browsers, image galleries, and so on rely on the Windows Codecs Library. The good news is this is one of the easier bugs to fix because the library is the same across all affected systems. However, Microsoft has deployed a patched version of the library in the Windows Store -- not via Windows Update. You don't have to do anything to get the patch, but you can manually pull down updates in the Store if you don't want to wait.
Now read:
