EXPOSURES › CVE-2020-0938
CVE-2020-0938
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in the Windows Adobe Font Manager Library allowed attackers to execute arbitrary code on vulnerable systems.
The vulnerability in the Adobe Font Manager Library allowed remote code execution on Windows systems, except Windows 10 where it was limited to an AppContainer sandbox. DIB organizations must ensure all Windows systems are patched, as this flaw was actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched vulnerabilities.
Shame score — A known, actively exploited remote code execution vulnerability that affected a wide range of Windows systems, demonstrating a failure to patch a critical flaw before it was weaponized.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited priv"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
"Microsoft CVEs and Security Vulnerabilities - OpenCVE"
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |