CVE-2020-1436

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Windows Font Library Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143607.8A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escal CVE-2020-143617.8A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege CVE-2020-143627.8A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege CVE-2020-143637.8An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an app CVE-2020-143645.0An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processi CVE-2020-143657.1A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packag CVE-2020-143667.5A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources CVE-2020-143676.0A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chr CVE-2020-143687.1A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, CVE-2020-143696.3This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted act CVE-2020-14377.8An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka CVE-2020-143705.3An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or th