Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Network
0

CVE-2018-1015

Disclosure Date: April 12, 2018 •
CVE-2018-1015 CVSS v3 Base Score: 8.8
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka “Microsoft Graphics Remote Code Execution Vulnerability.” This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, CVE-2018-1016.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Windows 7 32-bit Systems Service Pack 1
Windows 7 x64-based Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows RT 8.1
Windows Server 2008 32-bit Systems Service Pack 2
Windows Server 2008 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 Itanium-Based Systems Service Pack 2
Windows Server 2008 x64-based Systems Service Pack 2
Windows Server 2008 x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows 8.1 32-bit systems
Windows 8.1 x64-based systems
Windows Server 2016 (Server Core installation)
Windows Server 2008 R2 Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 x64-based Systems Service Pack 1
Windows Server 2008 R2 x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 32-bit Systems
Windows 10 Version 1511 for 32-bit Systems
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 x64-based Systems
Windows 10 Servers version 1709 (Server Core Installation)
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • microsoft

Products

  • windows 10 -,
  • windows 10 1511,
  • windows 10 1607,
  • windows 10 1703,
  • windows 10 1709,
  • windows 7 -,
  • windows 8.1,
  • windows rt 8.1 -,
  • windows server 2008 -,
  • windows server 2008 r2,
  • windows server 2012 -,
  • windows server 2012 r2,
  • windows server 2016 -,
  • windows server 2016 1709

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis