VULNERABILITY INTELLIGENCE

CVE-2015-1670

CVSS score4.3 MEDIUM
EPSS probability15.98%
CISA KEVNot currently listed
Published2015-05-13
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N

Description

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references