CVE-2019-1128

HIGH

Windows 10 and Windows Server 2016/2019 - Remote Code Execution in DirectWrite

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-1128. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit demonstrates a heap buffer overflow in AFDKO's readCharset() function due to insufficient bounds checking, leading to memory corruption. It targets Adobe Font Development Kit for OpenType (AFDKO) and can be triggered via Microsoft Edge when printing a specially crafted OpenType variable font.

Description

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/47095

The exploit demonstrates a heap buffer overflow in AFDKO's readCharset() function due to insufficient bounds checking, leading to memory corruption. It targets Adobe Font Development Kit for OpenType (AFDKO) and can be triggered via Microsoft Edge when printing a specially crafted OpenType variable font.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Font Development Kit for OpenType (AFDKO) and Microsoft DirectWrite
No auth needed
Prerequisites: A specially crafted OpenType variable font with a malformed charset descriptor · User interaction to print the font in Microsoft Edge
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.1694
EPSS Percentile 96.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (7)
microsoft/windows_10 1709
microsoft/windows_10 1803
microsoft/windows_10 1809
microsoft/windows_10 1903
microsoft/windows_server_2016 1803
microsoft/windows_server_2016 1903
microsoft/windows_server_2019
Published Jul 15, 2019
Tracked Since Feb 18, 2026