CVE-2020-0938

What is the Adobe Type Manager Library?

The Adobe Type Manager Library (atmfd.dll) is a font-rendering component built into Windows for parsing and displaying Adobe Type 1 PostScript fonts — used any time Windows renders text in this older font format, including in the Windows Preview Pane, which can trigger font parsing without a user ever fully opening a file.

Overview

CVE-2020-0938 is a remote code execution vulnerability in the Adobe Type Manager Library, triggered by processing specially crafted multi-master Adobe Type 1 PostScript fonts. Reported by Kaspersky's GReAT team, Microsoft took the unusual step of publishing Security Advisory ADV200006 in March 2020 — acknowledging the vulnerability, confirming limited targeted exploitation, and offering interim workarounds — nearly three weeks before an official patch was ready, because the flaw was already being actively exploited (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). On Windows 10, successful exploitation was limited to code execution inside an AppContainer sandbox with restricted privileges; on all other supported Windows versions, the impact was full unrestricted remote code execution.

Technical Details

The font-rendering code in atmfd.dll fails to properly validate certain structures within a crafted multi-master Adobe Type 1 PostScript font, corrupting memory during parsing in a way that can lead to code execution. Because font rendering can be triggered by Windows' Preview Pane, a victim could potentially trigger the vulnerable code path merely by having Explorer display a folder containing a malicious font file, without fully opening any application.

Discovery

Discovered and reported to Microsoft by Kaspersky's GReAT team, who identified it being exploited in narrow, targeted attacks — the same team credited with several other 2020 Windows 0-day discoveries covered on this site, including CVE-2020-0986 and CVE-2020-1380. Microsoft's advisory ADV200006 covered this CVE together with a second, closely related font-parsing bug, CVE-2020-1020 (also enriched on this site).

Exploitation Context

Microsoft's decision to publish an advisory with workarounds before a patch existed reflects genuine urgency: the vulnerability was confirmed to be under active, if limited, exploitation, and Microsoft judged that giving defenders interim mitigation guidance immediately outweighed the risk of publicizing an unpatched 0-day. The official fix followed in the next scheduled Patch Tuesday, April 14, 2020.

Remediation

1. Apply Microsoft's April 2020 Patch Tuesday update immediately if not already installed.
2. If a patch cannot yet be applied, use Microsoft's interim workarounds from ADV200006 — disabling the Preview Pane and Details Pane in Windows Explorer, and disabling the WebClient service, both of which reduce exposure to the font-parsing trigger path.
3. Be cautious with files and folders from untrusted sources in the window before patching, since Preview Pane rendering alone could potentially trigger the vulnerable code path.
4. Treat any unpatched Windows system as carrying confirmed-exploited risk for the roughly three-week period between the March 2020 advisory and the April 2020 patch, given Microsoft's direct acknowledgment of active targeted exploitation.