CVE-2020-0938: Windows Adobe Type Manager Library font parsing out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a confirmed exploited-in-the-wild RCE (KEV) with very high EPSS, but the CVSS vector requires local access and user interaction, tempering the immediate network risk.

What it is

The Windows Adobe Type Manager Library mishandles specially crafted multi-master Adobe Type 1 PostScript fonts, causing an out-of-bounds write (CWE-787). Successful exploitation allows remote code execution, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a confirmed real-world target.

Impact

An attacker who exploits the flaw can execute arbitrary code in the context of the affected process, giving full compromise of confidentiality, integrity and availability on the host. On systems other than Windows 10, the description states code can be executed remotely.

Attack surface

The CVSS vector is AV:L/PR:N/UI:R, so the attack is local to the target and requires user interaction, typically opening or previewing a malicious font file; no authentication or privileges are needed. The description notes remote execution is possible on all systems except Windows 10.

Exploitation

CVE-2020-0938 is in CISA's KEV catalog (added 2021-11-03), confirming exploitation in the wild, and EPSS gives a 30-day probability of 0.69166 (99.3rd percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows and Windows Server versions.
• Prioritize patching of unsupported or legacy platforms (Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2008/2012) that cannot receive current cumulative updates.
• Restrict or block untrusted font files at email gateways, web proxies and file shares, and disable font preview/rendering where feasible.
• Enforce least privilege and application control so a successful font-parsing exploit cannot easily escalate or persist.
• Track KEV remediation deadlines and verify patch compliance across the listed Windows 10, Windows Server 1803/1903/1909/2016/2019 builds.

Detection

• Monitor for processes loading or parsing untrusted font files, especially unusual .pfb/.pfm or PostScript Type 1 content delivered via email or downloads.
• Alert on crashes or out-of-bounds write indicators in font-parsing components (ATMFD/Adobe Type Manager) on endpoints.
• Hunt for suspicious child processes spawned by font-rendering or document-preview applications.
• Review EDR telemetry for exploitation attempts against the affected Windows builds and correlate with KEV patch status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.