CVE-2018-0760

MEDIUM

Microsoft Windows 7, Windows Server 2008, and Windows Server 2012 - Information Disclosure in EOT Font Engine

Title source: llm

Description

The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0755, CVE-2018-0761, and CVE-2018-0855.

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0760

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102953

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040374

Scores

CVSS v3 5.5

EPSS 0.0237

EPSS Percentile 81.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (3)

microsoft/windows_7

microsoft/windows_server_2008 r2 sp1

microsoft/windows_server_2012

Published Feb 15, 2018

Tracked Since Feb 18, 2026