cbcvebase.
CVE-2018-1016
published 2018-04-12

CVE-2018-1016: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote…

PriorityP259high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
23.49%
97.5th percentile
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, CVE-2018-1015.

Affected

21 ranges
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_server_2008
microsoftwindows_server_2012
microsoftwindows_server_2016
msrcwindows_10
msrcwindows_10_version_1511
msrcwindows_10_version_1607
msrcwindows_10_version_1703
msrcwindows_10_version_1709
msrcwindows_7
msrcwindows_8.1
msrcwindows_rt_8.1
msrcwindows_server_2008
msrcwindows_server_2008_r2
msrcwindows_server_2012
msrcwindows_server_2012_r2
msrcwindows_server_2016
msrcwindows_server_version_1709

Detection & IOCsextracted from sources · hover to see the quote

  • Attack vector: web-based delivery via specially crafted website hosting malicious embedded fonts — monitor for suspicious font file downloads or rendering in browser contexts
  • Attack vector: file-sharing / email attachment delivery via specially crafted document files containing embedded fonts — inspect Office/PDF documents for anomalous embedded font data
  • Vulnerable component is the Windows font library (ATMFD / win32k font parsing); focus detection on processes that parse embedded fonts (e.g., winword.exe, iexplore.exe, msedge.exe, chrome.exe) triggering anomalous kernel or graphics subsystem calls
  • Exploitation assessed 'More Likely' for both latest and older software releases — prioritise alerting on unpatched Windows systems (Windows 7, 8.1, 10, Server 2008/2012/2016) processing untrusted font content
  • ·No public exploit or active in-the-wild exploitation confirmed at time of advisory publication
  • ·CVE-2018-1016 is one of five related Microsoft Graphics font-handling RCE CVEs patched simultaneously; ensure detections distinguish it from CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, and CVE-2018-1015

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.