Main Vulnerability Database Vulnerabilities #VU22663

Input validation error in Microsoft Windows and Windows Server - CVE-2019-1419

Published: November 12, 2019 / Updated: November 12, 2019

Vulnerability identifier: #VU22663

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1419

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2019-1419

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1419

Related Security Bulletins