CVE-2017-11832

low-risk
Published 2017-11-15

The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed, due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-11835.

Do I need to act?

~
1.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.7/10 Medium
LOCAL / HIGH complexity

Affected Products (4)

Affected Vendors

Microsoft

References (6)

Third Party Advisory http://www.securityfocus.com/bid/101726
Third Party Advisory http://www.securitytracker.com/id/1039782
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-1183...
Third Party Advisory http://www.securityfocus.com/bid/101726
Third Party Advisory http://www.securitytracker.com/id/1039782
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-1183...
26
/ 100
low-risk
Severity 12/34 · Low
Exploitability 4/34 · Minimal
Exposure 10/34 · Low