# CVE-2020-1020: Windows Font Driver Type 1 VToHOrigin stack corruption

Type 1 font VToHOrigin handler in Windows font driver overflows 2-element stack arrays with up to 16 masters, giving write-what-where exploited in the wild.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: Mateusz Jurczyk, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-01-12)
- Disclosed: 2020-03-23
- CVE: CVE-2020-1020
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-1020.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-1020
- Tags: domain:desktop impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:regression technique:source-review vuln:memory-corruption

**Target:** Windows font driver (atmfd.dll / fontdrvhost.exe) Type 1 PostScript parser
**Root cause:** ParseBlendVToHOrigin declares ptrs[2] and values[2] but loops over g_font->numMasters (0-16), so 3+ masters cause out-of-bounds stack writes; values[4]/ptrs[4] overlap attacker-controlled data, yielding write-what-where.
**Steps:**
1. Craft Type 1 font with `/WeightVector [0 0 0 0 0]` setting numMasters=5
2. Add `/VToHOrigin[[16705.25490 -0.00001 0 0 16962.25882]]` under /Private/Blend
3. Load font; ParseBlendVToHOrigin writes values[4] (0x42424242) to ptrs[4] (0xffffffff41414141)
4. Repeat writes to place second-stage payload in RWX kernel memory at known address
5. Chain with CVE-2020-0938 stack corruption to return into payload
**How found:** Author reasons the rare, undocumented VToHOrigin Multiple Master object is unlikely to be hit by dumb fuzzing; likely found via semi-smart syntax-aware font fuzzing with object names scraped from atmfd.dll/fontdrvhost.exe, or manual audit of PostScript object handlers, or binary diffing against Adobe CoolType where it was already fixed.
**Exploitation:** On Windows 8.1 and earlier, the write-what-where primitive was used repeatedly to write a second-stage payload into RWX kernel memory at a known address, then chained with CVE-2020-0938 to redirect execution to it. Not exploited on Windows 10.
**Escalation:** Chained with CVE-2020-0938 (another font stack corruption) to gain control flow and execute kernel payload.
**Insight:** Legacy, undocumented PostScript Multiple Master objects (VToHOrigin, WeightVector) in font drivers are a blind spot; enumerate object handler names from the binary and fuzz them, or diff Microsoft's font engine against Adobe's fork to find missing fixes.