{"schemaVersion":3,"id":"CVE-2018-0760","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka \"Windows EOT Font Engine Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2018-0755, CVE-2018-0761, and CVE-2018-0855.","dates":{"published":"2018-02-15T02:00:00.000Z","modified":"2024-09-16T20:06:31.168Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.1,"severity":"low","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02322,"percentile":0.83219,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02322},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02437,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02322,"percentile":0.83219}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02437,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02322,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02322,"percentile":0.83219}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"microsoft corporation","product":"microsoft windows embedded opentype (eot) font engine","name":"Microsoft Windows Embedded OpenType (EOT) font engine","label":"microsoft windows embedded opentype (eot) font engine","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012.","noFixRecorded":false,"fixedIn":null}],"versionsText":"Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012.","eol":null,"hubHref":"/vendor/microsoft_corporation/microsoft_windows_embedded_opentype_eot_font_engine"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"r2:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"r2:sp1","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0760","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0760","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/102953","label":"www.securityfocus.com/bid/102953","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040374","label":"www.securitytracker.com/id/1040374","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-02-15T02:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T20:06:31.168Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:53:34.022Z","stale":false,"partial":false}}