CVE-2020-0938

CVE-2020-0938 is an out-of-bounds write (CWE-787) in the Windows Adobe Type Manager (Adobe Font Manager) Library, the Windows component that renders Adobe Type 1 PostScript fonts. It is triggered when the library improperly handles a specially crafted multi-master Adobe Type 1 PostScript font, typically when a user opens or previews a document or file containing the malicious font; the CVSS vector requires user interaction, and Microsoft notes that on systems other than Windows 10 the code execution can be achieved remotely. A successful attack lets the attacker execute arbitrary code with the privileges of the current user. Affected systems include Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 1909, and Windows Server versions 1803 and 1903, which together covered essentially the entire supported Windows install base in early 2020. Microsoft patched the flaw as one of three Windows zero-days actively exploited at the April 2020 Patch Tuesday, public reporting (including from Google) described a sophisticated hacking campaign using 11 different zero-days involving these Windows font bugs, and CISA added the CVE to its Known Exploited Vulnerabilities catalog in November 2021; EPSS estimates a 69% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept is known.

What to do: Apply the April 2020 Microsoft security updates (or later cumulative updates) to every affected Windows and Windows Server version, per Microsoft's instructions, and verify that end-of-life Windows 7, 8.1 and RT 8.1 machines received the final patches. Until systems are patched, reduce exposure using Microsoft's published mitigations: disable File Explorer's Preview and Details panes (a documented attack vector) and, for remote exploitation scenarios, the WebClient service, and caution users against opening or previewing untrusted documents and fonts. Check asset inventories for remaining Windows 7/8.1/RT 8.1 and Windows 10 1507–1909 builds, which no longer receive updates.