Loading vulnerability…
CVE-2020-1020 is a remote code execution vulnerability in Microsoft Windows caused by improper handling of a specially crafted multi-master font in Adobe Type 1 PostScript format by the Windows Adobe Type Manager Library. The flaw affects supported Windows and Windows Server versions. Successful exploitation allows remote code execution; for systems other than Windows 10, exploitation can result in direct remote code execution, while on Windows 10, Windows Server 2016, and Windows Server 2019 Microsoft stated exploitation is only possible within a limited AppContainer environment. The vulnerability was observed in limited in-the-wild attacks prior to patch release.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a local privilege escalation (LPE) exploit for CVE-2020-1020, targeting the Type1 font pool overflow vulnerability in Microsoft Windows 7, 8, and 8.1 x64 systems. The exploit is implemented in C/C++ and assembly, with the main logic in 'main.cpp', payloads in 'payload.cpp', and kernel-mode shellcode in 'shellcode.asm'. The exploit works by crafting malicious Type1 font files and injecting them into the Windows kernel using the 'NtGdiAddRemoteFontToDC' syscall wrappers (implemented in 'Syscall.asm' and referenced in 'def.h'). The shellcode replaces the current process token with the SYSTEM token, granting SYSTEM privileges to the attacker. The exploit requires local code execution on a vulnerable system and is not a detection script or part of a larger framework. The code is operational and includes all necessary payloads for privilege escalation.
This repository contains a local privilege escalation exploit for CVE-2020-1020, targeting the Windows Font Driver (Type 1) vulnerability on Windows 7 x64 systems. The main exploit logic is implemented in C++ (CVE-2020-1020-X64.cpp), with supporting assembly code (Syscall.asm) to perform direct kernel syscalls. The exploit crafts malicious font data and leverages the NtGdiAddRemoteFontToDC syscall to trigger a stack corruption vulnerability in the font driver. Upon successful exploitation, the code replaces the process token to escalate privileges, allowing arbitrary command execution as SYSTEM. The exploit is operational and requires local execution on a vulnerable Windows 7 x64 machine. The repository includes Visual Studio project files for building the exploit, but the core logic resides in the C++ and assembly source files.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability used by the Underminer exploit kit as part of its exploit chain targeting Chromium-based browsers, but not analyzed in detail in this content.
A Microsoft Windows vulnerability affecting all Windows versions, remediated in Microsoft's April 2020 security updates, with mitigations involving Windows Explorer preview/details panes, disabling WebClient, and renaming ATMFD.DLL.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.