CVE-2018-1015

8.8 highEPSS 23%

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, CVE-2018-1016.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 23% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2018-04-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microsoft:windows_10
microsoft:windows_7
microsoft:windows_8.1
microsoft:windows_rt_8.1
microsoft:windows_server_2008
microsoft:windows_server_2012
microsoft:windows_server_2016

References

http://www.securityfocus.com/bid/103600
http://www.securitytracker.com/id/1040656
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1015
http://www.securityfocus.com/bid/103600
http://www.securitytracker.com/id/1040656

Check your stack JSON