CVE-2020-1436: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1436) exists in the Windows font library when it improperly handles specially crafted fonts. The vulnerability affects multiple Windows versions and was disclosed in July 2020. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely (NVD).

The specific flaw exists within the parsing of fonts, where crafted data in a font can trigger a write past the end of a heap-based buffer, classified as an Out-of-bounds Write (CWE-787). The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, ZDI).

An attacker who successfully exploits this vulnerability could achieve remote code execution on affected systems. On local systems, attackers can leverage this vulnerability to escalate privileges and execute code in the context of the kernel, potentially gaining full system control (ZDI).

The vulnerability requires user interaction, as an attacker must first obtain the ability to execute low-privileged code on the target system. The attack complexity is considered low, requiring no privileges and only user interaction for successful exploitation (ZDI).

Microsoft has released security updates to address this vulnerability. Users are advised to apply the patches provided through the Microsoft security advisory (MSRC).

The vulnerability was initially discovered and reported through the Zero Day Initiative program, with the disclosure timeline showing the vulnerability was reported to Microsoft on May 7, 2020, and publicly released on July 16, 2020 (ZDI).