CVE-2020-1020

What is the Adobe Type Manager Library?

The Adobe Type Manager Library (atmfd.dll) is a Windows font-rendering component for Adobe Type 1 PostScript fonts, used whenever Windows displays text in this legacy font format — including via the Explorer Preview Pane, which can trigger font parsing without a file being fully opened.

Overview

CVE-2020-1020 is one of two remote code execution vulnerabilities Microsoft disclosed together under Security Advisory ADV200006 in March 2020 — alongside CVE-2020-0938 (also enriched on this site) — both triggered by processing specially crafted multi-master Adobe Type 1 PostScript fonts, and both confirmed to be under limited, targeted active exploitation before a patch existed (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High). As with its companion CVE, exploitation on Windows 10 was constrained to an AppContainer sandbox with limited privileges and capabilities; on other supported Windows versions, impact was full unrestricted remote code execution.

Technical Details

The vulnerability lies in the same general area of atmfd.dll's font-parsing logic as CVE-2020-0938 — insufficient validation of structures within a crafted multi-master font leads to memory corruption during parsing. Whether this represents a distinct code path from CVE-2020-0938 or a closely related variant within the same parsing routine, Microsoft's advisory treated both as needing to be addressed by the same April 2020 fix.

Discovery

Reported to Microsoft by Kaspersky's GReAT team as part of the same investigation that identified CVE-2020-0938, both confirmed to be exploited in narrow, targeted attacks.

Exploitation Context

See CVE-2020-0938 for the full context of Microsoft's unusual decision to publish an advisory with interim workarounds nearly three weeks before the official patch, driven by confirmed active exploitation of this vulnerability pair.

Remediation

1. Apply Microsoft's April 2020 Patch Tuesday update immediately — this single update addresses both this CVE and CVE-2020-0938.
2. Use Microsoft's interim workarounds from ADV200006 if immediate patching isn't possible — disabling the Preview Pane and Details Pane in Explorer, and disabling the WebClient service.
3. Be cautious with files and folders from untrusted sources during the exposure window, since Preview Pane rendering alone could trigger the vulnerable parsing path.
4. Treat this CVE and CVE-2020-0938 as a single remediation item — both are fixed by the same patch and were both under active exploitation.