The Windows Graphics component, which is responsible for the graphics on your Windows screen, hosts a font library which could be rigged with specially crafted embedded fonts. Due to the improper handling of Windows fonts library, there could be a remote code execution in which the attacker can gain full access to your system.

As per Microsoft's Security advisory, "there are multiple ways an attacker could exploit the vulnerability:

• In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.
  
• In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability and then convince users to open the document file.
  
• An attacker could also embed an ActiveX control marked ‘safe for initialization’ in an application or Microsoft Office document that hosts the IE rendering engine."
  

A denial of service vulnerability also exists in Windows Graphics; it could allow the attacker to cause a vulnerable system to stop responding. This flaw is due to improper handling of objects in memory.

Microsoft released a cumulative security update addressing all the critical remote code execution vulnerabilities in Windows Graphics Component. The CVE numbers are as below:

• CVE-2018-1010
  
• CVE-2018-1012
  
• CVE-2018-1013
  
• CVE-2018-1015
  
• CVE-2018-1016
  

Reiterating, if you're a Windows user, irrespective of whether you use Windows 10 / 8.1 / RT 8.1 / 7, or Windows Servers 2008 / 2012 / 2016, you may still be at risk until you apply the latest patches from Microsoft's April patch release.

ManageEngine's Patch Management now allows you to easily apply the latest patches from its 'Critical Vulnerabilities' tab on the console. 38 patches are covered under 'Critical Vulnerabilities'.