Microsoft Warns of Critical Vulnerability in Windows

[engine]

Microsoft has warned of a critical vulnerability in Windows which is currently unpatched, which it says is working on a fix.

Two remote code execution vulnerabilities exist in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.

There are multiple ways an attacker could exploit the vulnerability, such as convincing a user to open a specially crafted document or viewing it in the Windows Preview pane.

[portal.msrc.microsoft.com...]

[lammert]

Adobe type 1 fonts can be used in PDF, so I guess PDF files embedded in emails will be a main attack vector for this vulnerability.

Worth noting is that Microsoft specifically mentions this as "targeted Windows 7 based attacks". Windows 7 support was discontinued not long ago and this is an extra reminder for those still using this OS (note to self) to upgrade to Windows 10.

[JS_Harris]

Hopefully nobody needs reminders anymore that nothing done online is ever entirely private or secure.

[tangor]

... or that Adobe is not your friend.

</dry humor>