CVE-2020-0938

Deeper analysis

The vulnerability is a remote code execution flaw in Microsoft Windows stemming from improper handling of specially crafted multi-master fonts in Adobe Type 1 PostScript format by the Windows Adobe Type Manager Library. It is tracked under CWE-787 and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, and no privileges required but with user interaction needed. The issue affects Windows systems other than Windows 10 and is distinct from the related CVE-2020-1020.

An attacker can exploit the flaw by supplying a malicious font file that triggers the vulnerability during processing, enabling remote code execution on affected systems except Windows 10. Successful exploitation grants the attacker the ability to run arbitrary code with the privileges of the current user, potentially leading to full system compromise including confidentiality, integrity, and availability impacts.

Microsoft's security advisory and the CISA Known Exploited Vulnerabilities catalog reference patches and guidance for addressing the issue through standard update mechanisms. The presence of the CVE in the CISA catalog indicates confirmed real-world exploitation activity.