CVE-2020-1020: Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

High severity · published Apr 15, 2020

CVE-2020-1020

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

In wildKEV

8.8

CVSS

65%

EPSS

Yes

On KEV

Description

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)65.0% · higher than 99% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useNot known

Affected products

Which versions

Windows · Microsoft

10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; +12 more · source: vendor, KEV

Windows 10 Version 1903 for 32-bit Systems · Microsoft