PT-2010-3507 · Microsoft · Windows

Published 2010-10-12 · Updated 2025-01-21 · CVE-2010-1883

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description A remote code execution issue exists in the way Microsoft Windows Embedded OpenType (EOT) font technology parses certain tables in specially crafted embedded fonts. This allows remote attackers to execute arbitrary code via a crafted table in an embedded font. If a user is logged on with administrative user rights, an attacker who successfully exploited this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users operating with administrative user rights.

Recommendations For Microsoft Windows, update to a version that includes the fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting the use of embedded fonts in sensitive environments until a patch is available.

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

CVE-2010-1883

ZDI-10-198

Affected Products

Windows

References · 8

• https://zerodayinitiative.com/advisories/ZDI-10-198 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-1883 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-076 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6881 · Note
• https://t.me/cvenotify/108077 · Telegram Post
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-076 · Note