cbcvebase.
CVE-2018-1010
published 2018-04-12

CVE-2018-1010: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote…

PriorityP262high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
40.07%
98.5th percentile
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1012, CVE-2018-1013, CVE-2018-1015, CVE-2018-1016.

Affected

21 ranges
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_server_2008
microsoftwindows_server_2012
microsoftwindows_server_2016
msrcwindows_10
msrcwindows_10_version_1511
msrcwindows_10_version_1607
msrcwindows_10_version_1703
msrcwindows_10_version_1709
msrcwindows_7
msrcwindows_8.1
msrcwindows_rt_8.1
msrcwindows_server_2008
msrcwindows_server_2008_r2
msrcwindows_server_2012
msrcwindows_server_2012_r2
msrcwindows_server_2016
msrcwindows_server_version_1709

Detection & IOCsextracted from sources · hover to see the quote

  • Exploit vector 1: attacker hosts a specially crafted website with malicious embedded fonts to trigger the vulnerability when visited
  • Exploit vector 2: attacker delivers a specially crafted document file containing malicious embedded fonts as an email attachment or shared file
  • Root cause is in the Windows font library mishandling specially crafted embedded fonts; focus detection on anomalous font parsing activity in Windows Graphics components
  • Successful exploitation grants full system control including program installation, data manipulation, and account creation — monitor for unexpected privilege escalation following document/web content rendering
  • ·Exploit Status is rated 'Exploitation More Likely' for both latest and older software releases, indicating elevated risk despite no confirmed in-the-wild exploitation at time of advisory
  • ·CVE-2018-1010 is one of several related Microsoft Graphics RCE vulnerabilities patched simultaneously; ensure detections and patches are not conflated with CVE-2018-1012, CVE-2018-1013, CVE-2018-1015, or CVE-2018-1016

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.