Medium severity5.5NVD Advisory· Published Nov 15, 2017· Updated Jun 17, 2026

CVE-2017-11835

Description

Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11832.

Affected products

Microsoft/Windows 7
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
Microsoft/Windows Server 20082 versions
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
Microsoft/Embedded OpenType Font Enginellm-fuzzy
Microsoft/Windowsllm-fuzzy
Microsoft Corporation/Microsoft Graphicsv5
Range: Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1.

Patches

Vulnerability mechanics

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11835nvdPatchVendor Advisory
www.securityfocus.com/bid/101736nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1039782nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000