cbcvebase.
CVE-2018-1013
published 2018-04-12

CVE-2018-1013: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote…

PriorityP259high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
23.49%
97.5th percentile
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1010, CVE-2018-1012, CVE-2018-1015, CVE-2018-1016.

Affected

21 ranges
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_server_2008
microsoftwindows_server_2012
microsoftwindows_server_2016
msrcwindows_10
msrcwindows_10_version_1511
msrcwindows_10_version_1607
msrcwindows_10_version_1703
msrcwindows_10_version_1709
msrcwindows_7
msrcwindows_8.1
msrcwindows_rt_8.1
msrcwindows_server_2008
msrcwindows_server_2008_r2
msrcwindows_server_2012
msrcwindows_server_2012_r2
msrcwindows_server_2016
msrcwindows_server_version_1709

Detection & IOCsextracted from sources · hover to see the quote

  • Exploit vector 1: attacker hosts a specially crafted website with embedded malicious fonts to trigger the vulnerability when visited by a user
  • Exploit vector 2: attacker delivers a specially crafted document file containing malicious embedded fonts as an email attachment or shared file
  • Root cause is in the Windows font library mishandling specially crafted embedded fonts; monitor for anomalous font parsing activity in Windows Graphics components
  • Successful exploitation grants full system control including program installation, data manipulation, and account creation — look for unexpected child processes or privilege escalation following document/browser activity
  • Microsoft assessed exploitation as 'More Likely' for both latest and older software releases — prioritize detection on unpatched Windows systems across all supported versions
  • ·CVE-2018-1013 is one of several related Microsoft Graphics RCE vulnerabilities patched simultaneously; do not conflate with CVE-2018-1010, CVE-2018-1012, CVE-2018-1015, or CVE-2018-1016, which share the same vulnerability class but are distinct CVEs
  • ·No public exploit or active in-the-wild exploitation was confirmed at time of disclosure
  • ·Affected scope is broad — covers Windows 7, 8.1, RT 8.1, 10, Server 2008/2008 R2, 2012/2012 R2, 2016, and Windows 10 Servers; ensure detection and patching coverage across all these platforms

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.