CVE-2018-1010

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1012, CVE-2018-1013, CVE-2018-1015, CVE-2018-1016.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/103594Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040656Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1010Patch, Vendor Advisory
http://www.securityfocus.com/bid/103594Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040656Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1010Patch, Vendor Advisory

Timeline

Published: Apr 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101006.1Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.CVE-2018-101016.1Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.CVE-2018-101026.1Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.CVE-2018-101039.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).CVE-2018-101059.8tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).CVE-2018-101069.8D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have permission bypass and information disclosure CVE-2018-101076.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webin CVE-2018-101086.1D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webi CVE-2018-101094.8Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content secti CVE-2018-10117.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-101104.8D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-101117.5An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, l