CVE-2017-11832 — The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed, due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-11835

Back Back to CVE browser

MEDIUM

The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed, due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-11835

Published Nov 15, 2017

4.7

MEDIUM

CVSS 3.0

EPSS 2.09%

Description

The Microsoft Windows embedded OpenType (EOT) font engine in Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012 allows an attacker to potentially read data that was not intended to be disclosed, due to the way that the Microsoft Windows EOT font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-11835.

Affected products

Vendor Microsoft Corporation Product Microsoft Graphics Component Default
n/a
- Version
  Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft Corporation

Microsoft Graphics Component

n/a

Version	Status	Constraints
Windows 7 SP1, Windows Server 2008 SP2 and 2008 R2 SP1, and Windows Server 2012.	affected	-

Remediation

No remediation recorded yet.

Metrics

2.09% 0.02091

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02091

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.09% (0.02091)	80.93th	v5 (v2026.06.15)
Jun 15, 2026	2.09% (0.02091)	79.11th	v5 (v2026.06.15)
Mar 17, 2025	1.18% (0.01177)	77.26th	v4 (v2025.03.14)
Dec 12, 2024	0.08% (0.00083)	37.18th	v3 (v2023.03.01)
Mar 7, 2023	0.08% (0.00076)	30.73th	v3 (v2023.03.01)
Mar 6, 2023	1.42% (0.01418)	73.14th	v2 (v2022.01.01)
Apr 1, 2022	1.42% (0.01418)	71.15th	v2 (v2022.01.01)
Feb 4, 2022	1.42% (0.01418)	50.43th	v2 (v2022.01.01)
Feb 3, 2022	8.76% (0.08756)	86.41th	v1
Jan 6, 2022	8.76% (0.08756)	86.25th	v1
Sep 1, 2021	8.76% (0.08756)	93.70th	v1
Apr 14, 2021	8.76% (0.08756)	0.00th	v1

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

http://www.securityfocus.com/bid/101726
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039782
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11832
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/101726		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039782		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11832		x_refsource_CONFIRMPatchVendor Advisory