EXPOSURES › CVE-2020-1020
CVE-2020-1020
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in Windows' Adobe Font Manager Library allowed attackers to execute arbitrary code on systems running Windows 10 and earlier.
The vulnerability in the Adobe Font Manager Library allowed remote code execution on Windows 10 and earlier systems, while limiting impact to a sandboxed context on Windows 11. DIB organizations must ensure all Windows systems are patched, as this flaw was actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched vulnerabilities.
Shame score — Microsoft failed to patch a known, actively exploited remote code execution vulnerability for years, allowing widespread compromise of Windows systems.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited priv"
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |