Heap-based buffer overflow in Microsoft Windows and Windows Server - CVE-2016-7274

Vulnerability identifier: #VU3796

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7274

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in LoadUvsTable() function when processing .ttf files. A remote attacker can create a specially crafted TTF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Microsoft Windows
Windows Server

Install updates from vendor's website.

• Exploit #728 - Microsoft Windows - 'LoadUvsTable()' Heap-based Buffer Overflow (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms16-147.aspx
• http://blogs.flexerasoftware.com/secunia-research/2016/12/microsoft_windows_loaduvstable_heap_based_...

• Remote code execution in Microsoft Uniscribe
• Uniscribe Remote Code Execution Vulnerability