CVE-2020-0938
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
Description
CVE-2020-0938 is a HIGH-severity remote code execution vulnerability in the Microsoft Windows Adobe Font Manager Library with a CVSS 3.1 score of 7.8. The vulnerability exists when the Windows Adobe Type Manager Library improperly handles specially crafted multi-master fonts in Adobe Type 1 PostScript format. For systems other than Windows 10, successful exploitation allows full remote code execution. On Windows 10, exploitation is limited to code execution within an AppContainer sandbox with restricted privileges. Affected products span Windows 7 through Windows 10 (multiple builds) and Windows Server 2008 through 2019. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The exceptionally high EPSS score of 0.89566 (99.55th percentile) indicates extremely high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161299/Apple-CoreText-libFontParser.dylib-Stack-Corruption.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0938(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0938(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2020-0938 is classified under CWE-787 — Out-of-bounds Write. This weakness occurs when software writes data past the end of an intended buffer or before the beginning of a buffer. Out-of-bounds write operations can corrupt adjacent memory, overwrite critical data structures including function pointers and return addresses, and ultimately enable arbitrary code execution.
In the context of the Windows Adobe Font Manager Library, the out-of-bounds write is triggered during the parsing of specially crafted Adobe Type 1 PostScript font data. Font parsing vulnerabilities are particularly dangerous because fonts are automatically processed when documents are opened or previewed, enabling attack scenarios where simply viewing a document in Windows Explorer can trigger exploitation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-0938 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker access to all data accessible by the compromised process. On non-Windows 10 systems, this means unrestricted access to user data, credentials, and potentially system-level information.
Integrity (HIGH): Attackers can modify files, install malware, alter system configurations, and deploy persistent backdoors on compromised systems.
Availability (HIGH): The vulnerability can cause application crashes, system instability, or complete denial of service through malformed font processing.
Scope Unchanged: The vulnerability's scope is Unchanged (U). On Windows 10, impact is further contained within the AppContainer sandbox. On older Windows versions, the impact is limited to the user context but can be escalated through additional vulnerabilities.
With an EPSS score of 0.89566 (99.55th percentile), this vulnerability is among the most likely to be exploited across all tracked vulnerabilities.
Exploit Maturity
CVE-2020-0938 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was exploited as a zero-day before patches were available. Microsoft acknowledged limited targeted attacks in March 2020 before releasing the April 2020 security update. The EPSS score of 0.89566 (99.55th percentile) places it among the most exploited vulnerabilities tracked globally.
Ransomware association: No direct ransomware association has been confirmed per KEV data. However, remote code execution vulnerabilities in font handling libraries have historically been leveraged by advanced threat actors for targeted intrusions.
Attack surface: The vulnerability can be triggered by opening a document containing a malicious font, previewing a file in Windows Explorer, or browsing to a webpage serving crafted font content. The diverse attack surface makes exploitation accessible through multiple vectors.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Organizations should prioritize remediation given the confirmed exploitation history.
Remediation
- Apply Microsoft security updates immediately. Install the April 2020 security updates per Microsoft's advisory at portal.msrc.microsoft.com.
- Identify all affected systems. Inventory all Windows 7, 8.1, 10, RT 8.1, and Windows Server 2008 through 2019 instances. Prioritize systems running Windows versions older than Windows 10 due to the more severe impact.
- Disable the Windows Preview Pane as interim mitigation. If immediate patching is not possible, disable the Preview Pane and Details Pane in Windows Explorer to prevent automatic font rendering from triggering exploitation.
- Disable the WebClient service. Disabling WebDAV reduces the remote attack surface by preventing exploitation through web-based vectors.
- Monitor for indicators of compromise. Review security logs for evidence of exploitation, focusing on anomalous processes spawned from font rendering operations and unexpected network connections.
- Prioritize migration from end-of-life systems. Windows 7 and Server 2008 systems are at greatest risk. Plan immediate migration to supported operating system versions.
Technical Details
CVE-2020-0938 is a HIGH-severity remote code execution vulnerability that requires local access and user interaction to exploit. The attack complexity is low, no privileges are required, but the victim must open a malicious document or preview a crafted file.
Technical mechanism: The vulnerability resides in the Windows Adobe Type Manager Library (atmfd.dll), which handles Adobe Type 1 PostScript font rendering. When processing specially crafted multi-master font data, the library performs an out-of-bounds write that corrupts heap memory. By carefully structuring the font data, an attacker can control the memory corruption to overwrite function pointers and achieve code execution in the context of the calling process.
Attack scenarios: (1) Opening a document embedding a malicious Type 1 font, (2) Previewing a font file in Windows Explorer, (3) Visiting a website that serves crafted font content. The Explorer preview scenario is particularly dangerous as it requires minimal user interaction.
CVSS 3.1 vector analysis: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — While the attack vector is classified as LOCAL, exploitation can be triggered remotely through document-based attacks requiring user interaction.
Affected products: Windows 10 (1507 through 1909), Windows 7, Windows 8.1, Windows RT 8.1, and Windows Server 1803 through 2019.
Frequently Asked Questions
Is CVE-2020-0938 being actively exploited?
Yes, CVE-2020-0938 has been actively exploited in the wild. It was initially exploited as a zero-day before Microsoft released patches in April 2020. The EPSS score of 0.89566 (99.55th percentile) confirms extremely high exploitation likelihood, and the vulnerability is listed in CISA's KEV catalog.
Which products are affected by CVE-2020-0938?
CVE-2020-0938 affects Microsoft Windows products including Windows 7, Windows 8.1, Windows 10 (builds 1507 through 1909), Windows RT 8.1, and multiple Windows Server versions (1803, 1903, 1909, 2008, 2012, 2016, 2019). Non-Windows 10 systems are at greater risk as exploitation achieves full code execution outside a sandbox.
How do I fix CVE-2020-0938?
Apply the April 2020 security updates from Microsoft. As interim mitigations, disable the Windows Explorer Preview Pane and Details Pane to prevent automatic font rendering, and disable the WebClient service to reduce the remote attack surface. Prioritize migration from end-of-life operating systems.
How severe is CVE-2020-0938?
CVE-2020-0938 is rated HIGH with a CVSS 3.1 score of 7.8. On non-Windows 10 systems, exploitation achieves full remote code execution. On Windows 10, impact is contained within the AppContainer sandbox. The EPSS score of 0.89566 (99.55th percentile) places it among the most exploited vulnerabilities worldwide.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.