CVE-2014-4148highunder attackCWE-94

CVE-2014-4148

Published · Updated

Follow this CVE+ Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 60%
from disclosure to weapon
Published on NVDOct 15
CISA KEV+2779d
Action required by CISAfederal deadline: 2022-06-15

Apply updates per vendor instructions.

In short

A flaw in Windows font handling allows attackers to run malicious code by sending a specially crafted TrueType font file. This is dangerous because fonts are often trusted and downloaded automatically by browsers and applications.

Technical detail

The vulnerability exists in win32k.sys kernel-mode driver's TrueType font parsing logic (CWE-94: Improper Control of Generation of Code), allowing remote code execution when a specially crafted font is processed. No user interaction beyond normal font processing is required; the attacker can deliver the malicious font via web browsers or email attachments.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka "TrueType Font Parsing Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a