Is CVE-2020-0938 (Microsoft Windows Adobe Font Manager Library Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2020-0938 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10.

What CISA’s KEV listing tells you about active exploitation

For a CVE like this, the practical question is not whether the flaw exists, but whether it has crossed from theoretical exposure into confirmed attacker use. A KEV listing means CISA has enough evidence to treat the issue as actively exploited, so defenders should assume opportunistic scanning and follow-on exploitation are already part of the threat picture.

That changes prioritisation. Even if exploit details are sparse, the combination of remote code execution and KEV status is enough to put exposure confirmation, patch urgency, and compromise checking ahead of routine maintenance queues. The correct reading is: this is not a “watchlist” item, it is an active-response item.

How to confirm exposure and assess blast radius

Start by identifying every Windows system that could plausibly host the affected Adobe Font Manager Library path or any application stack that uses the vulnerable font-handling component. Because the vulnerable condition is triggered during handling of specially crafted fonts, the operational question is where untrusted font content can enter the environment, including document workflows, file conversion services, and user-facing endpoints.

Use your normal asset inventory, vulnerability scanning, and software bill of materials data to locate hosts that are both reachable and likely to process external content. CISA’s Known Exploited Vulnerabilities Catalog is the authoritative source for the exploitation status, while the vendor advisory remains the source for exact affected and fixed builds.

What remediation looks like when patching is delayed

The preferred action is to apply the vendor fix as soon as your change window allows, but if patching must wait, reduce exposure to the vulnerable parsing path. That means limiting delivery of untrusted documents and font content, tightening email and file-transfer controls, and isolating systems that must process high-risk content. Where feasible, treat the component as a remote-code-execution surface rather than a benign document feature.

If you cannot patch immediately, put compensating controls around the systems most likely to receive attacker-controlled fonts. Zero-Day and Exploited Vulnerabilities Guide is useful here because the response pattern is the same: confirm exposure, prioritise emergency mitigation, and hunt for signs of compromise rather than waiting for the next standard cycle.

Risk and Threat Considerations

Remote code execution flaws in widely deployed Windows components are attractive because they can turn a single malformed input into full host compromise. When the issue is already in KEV, the risk is no longer just unauthorised execution, but rapid weaponisation across exposed endpoints and any workflow that processes externally supplied content.

Failure mechanism: An attacker supplies or delivers a specially crafted multi-master font that triggers the vulnerable parsing logic in the Adobe Font Manager Library, allowing code execution in the context of the victim system.

Impact: Successful exploitation can lead to system takeover, payload staging, lateral movement, or additional credential and data exposure if the host is reachable and trusted by other internal assets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed RCEs require rapid identification and remediation prioritization.
Recommendation — Prioritise, patch, and verify every exposed asset before the next routine maintenance cycle.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management Plan	Active exploitation calls for formal prioritisation and coordinated remediation handling.
Recommendation — Use a vulnerability management process to accelerate remediation and document exceptions.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE demands prompt remediation and verification of vulnerable systems.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation depends on locating affected systems and monitoring for vulnerable software.
Recommendation — Apply flaw-remediation procedures to install the vendor fix and confirm completion. Scan for the vulnerable component and track exposure until all affected hosts are resolved.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	A KEV-listed RCE is a technical vulnerability requiring managed remediation and tracking.
Recommendation — Treat the issue as a managed technical vulnerability and drive timely remediation.

Practitioner Guidance

What to verify: Confirm not only whether the patch is installed, but whether the affected component is reachable in any business process that ingests external files or documents. A patched endpoint that still accepts untrusted content through a high-trust workflow remains a meaningful residual-risk condition.

Decision rule: If a system can receive attacker-controlled fonts, documents, or file conversions from outside your trust boundary, prioritise it for immediate remediation or isolation before lower-value endpoints. If the host is business-critical and cannot be patched quickly, document the exception with a concrete exposure owner and a rollback date.

Practitioner takeaway: For an actively exploited RCE, the right sequence is exposure check, urgent remediation, then compromise hunting, because waiting for symptom-based detection is usually too late.