Cloudanix VulnDB

CVE-2020-0938

High · 7.8 CISA KEV

CVSS

7.8

EPSS

69.0%

Published

Apr 15, 2020

CISA due date

May 3, 2022

Cloudanix analysis

Act now SSVC: Attend

A flaw in how Windows handles certain font files could let an attacker take over a computer when someone opens a specially made document.

Active In The Wild
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of specially crafted multi-master Adobe Type 1 PostScript fonts in the Windows Adobe Type Manager Library causes memory corruption that permits arbitrary code execution with the privileges of the current user.

Why it matters to the business

Attackers can achieve full system compromise on unpatched Windows systems, enabling data theft, ransomware deployment, or persistence; the flaw remains actively exploited in the wild with a past CISA KEV deadline, increasing risk for organizations still running legacy Windows versions.

How an attack unfolds

An attacker crafts a malicious multi-master font file and delivers it inside a document or archive. When the victim opens the file on a vulnerable Windows system, the Adobe Type Manager Library processes the font, triggering memory corruption that leads to remote code execution. The vulnerability has been observed exploited in the wild.

How to fix it

Apply the latest cumulative security updates for all supported Windows versions. Disable the Adobe Type Manager Library where feasible via registry or Group Policy. Remove or isolate legacy systems that cannot be updated.

How to confirm the fix worked

Verify installation of applicable Microsoft security updates via WSUS, Microsoft Update Catalog, or endpoint management tools. Confirm atmfd.dll version matches patched releases and test font handling in isolated environments.

Typical attack path

  1. Craft malicious multi-master font exploiting memory corruption in Adobe Type Manager Library
  2. Embed font in document or archive and deliver via email, web download, or shared storage
  3. Victim opens file triggering font parsing
  4. Memory corruption leads to arbitrary code execution
  5. Attacker establishes foothold, escalates privileges, or installs malware

How to detect it

Search endpoint logs and EDR telemetry for crashes or unexpected execution involving atmfd.dll during document or font processing. Review Windows Event Logs for application faults tied to font rendering and correlate with file creation or download events preceding suspicious processes.

  • atmfd.dll
  • unexpected execution of rundll32.exe loading font resources
  • application crash events with faulting module atmfd.dll

What your security team should do

  • Immediately patch all systems still running affected Windows versions given KEV status and active exploitation
  • Implement application allow-listing and restrict font file sources from untrusted origins
  • Monitor for font-related crashes and enable enhanced logging on legacy endpoints
  • Plan migration off end-of-life Windows releases that cannot receive updates

The record

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities