CVE-2020-1020
Published: 15 April 2020
Summary
CVE-2020-1020 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Windows 10 1803. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Deeper analysis
A remote code execution vulnerability tracked as CVE-2020-1020 exists in the Windows Adobe Type Manager Library when it improperly processes a specially crafted multi-master font in Adobe Type 1 PostScript format. The flaw affects Microsoft Windows systems and is distinct from the related CVE-2020-0938. It carries a CVSS 3.1 base score of 8.8 and is associated with CWE-787.
An unauthenticated attacker can exploit the issue over a network by convincing a user to open or preview a malicious document containing the crafted font. Successful exploitation grants remote code execution with high impact to confidentiality, integrity, and availability on all affected Windows versions except Windows 10, where the impact is limited.
Microsoft security advisories at portal.msrc.microsoft.com detail patches and mitigation guidance for the vulnerability. The flaw is also catalogued by CISA among actively exploited vulnerabilities in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-11916
Vulnerability details
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability…
more
could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying Microsoft patches that remove the vulnerable Adobe Type Manager Library code paths handling malicious Type 1 fonts.
Malicious-code protection mechanisms can inspect or sandbox documents containing crafted fonts before the vulnerable library processes them.
Integrity verification of system libraries and fonts can block or alert on unauthorized or tampered font files used to trigger the flaw.