CVE-2011-3402
Microsoft Windows Remote Code Execution Vulnerability
Description
CVE-2011-3402 is a critical vulnerability in the TrueType font parsing engine within win32k.sys, a kernel-mode driver in Microsoft Windows. This flaw allows remote attackers to execute arbitrary code by embedding crafted font data in a Word document or web page. Exploited in the wild as part of the Duqu malware campaign — widely considered a successor to Stuxnet — this vulnerability affected Windows XP, Server 2003, Vista, Server 2008, and Windows 7. With an EPSS score of 0.89217 (99.5th percentile) and inclusion in CISA's KEV catalog with a remediation deadline of October 27, 2025, CVE-2011-3402 remains one of the most significant kernel-level remote code execution vulnerabilities in Windows history.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2003 | - |
| microsoft | windows server 2008 | - |
| microsoft | windows vista | - |
| microsoft | windows xp | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files(Broken Link)
- http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx(Vendor Advisory)
- http://isc.sans.edu/diary/Duqu+Mitigation/11950(Third Party Advisory)
- http://secunia.com/advisories/49121(Vendor Advisory)
- http://secunia.com/advisories/49122(Vendor Advisory)
- http://technet.microsoft.com/security/advisory/2639658(Vendor Advisory)
- http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two(Not Applicable)
- http://www.securitytracker.com/id?1027039(Broken Link)
- http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit(Not Applicable)
- http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf(Not Applicable)
- http://www.us-cert.gov/cas/techalerts/TA11-347A.html(US Government Resource)
- http://www.us-cert.gov/cas/techalerts/TA12-129A.html(US Government Resource)
- http://www.us-cert.gov/cas/techalerts/TA12-164A.html(US Government Resource)
- http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf(US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087(Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034(Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039(Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3402(US Government Resource)
Weakness Type
No Specific CWE Assigned
Microsoft has not assigned a specific CWE identifier to CVE-2011-3402. Based on the vulnerability's characteristics, it involves improper parsing and validation of TrueType font data within the win32k.sys kernel-mode driver. The vulnerability class most closely aligns with CWE-20 (Improper Input Validation) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), as the TrueType font engine fails to properly validate font data structures before processing them, leading to kernel memory corruption and arbitrary code execution with kernel privileges.
Impact Analysis
The business impact of CVE-2011-3402 is critical because it provides remote kernel-level code execution — one of the most severe vulnerability categories possible. Confidentiality Impact is high because exploitation occurs in kernel mode, granting the attacker the highest possible system privileges and access to all data on the system, including credentials, encryption keys, and data from all user accounts. Integrity Impact is high as kernel-level access allows the attacker to modify any file, install rootkits that operate below the operating system's security controls, and tamper with all system components including security software. Availability Impact is high since the attacker can crash the system (blue screen), disable services, or render the machine permanently compromised. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring only that a user opens a crafted document or visits a malicious webpage (UI:R). No authentication is needed (PR:N). The EPSS score of 0.89217 (99.5th percentile) confirms near-certain exploitation. The historical connection to the Duqu malware, linked to nation-state actors and the Stuxnet campaign, demonstrates that this vulnerability was leveraged in sophisticated, targeted operations against critical infrastructure and high-value targets. The KEV catalog listing with ransomware status "Unknown" indicates continued relevance.
Exploit Maturity
CVE-2011-3402 has one of the most notable exploitation histories of any Windows vulnerability. It was exploited as a zero-day by the Duqu malware, which security researchers consider a direct descendant of the Stuxnet worm used to sabotage Iranian nuclear facilities. The exploitation was documented by McAfee Labs in their analysis connecting Duqu to the broader Stuxnet ecosystem. CISA has included CVE-2011-3402 in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 27, 2025, and ransomware association is listed as "Unknown." The EPSS score of 0.89217 (99.5th percentile) indicates an extremely high exploitation probability. Microsoft responded with Security Advisory 2639658 and a subsequent MSRC blog post acknowledging the threat. The SANS Internet Storm Center published mitigation guidance for the vulnerability. The nation-state-grade exploitation quality and the availability of detailed technical analysis make this one of the most significant and well-documented exploitation cases in cybersecurity history.
Remediation
- Apply the Microsoft security update MS12-034. Install the security update that addresses CVE-2011-3402 by fixing the TrueType font parsing vulnerability in win32k.sys. This update is available through Windows Update and was released as part of Microsoft Security Bulletin MS12-034. Ensure all affected Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2/R2 SP1, Windows 7/SP1) are fully patched.
- Migrate to a modern supported Windows version. All operating systems affected by CVE-2011-3402 have reached end of life. Upgrade to Windows 10 22H2 or Windows 11 to benefit from improved kernel-mode font parsing security, including the isolation of font rendering from the kernel into a user-mode process (win32kfull.sys changes) introduced in later Windows versions.
- Disable TrueType font rendering as a temporary mitigation. If immediate patching is not possible, apply the workaround described in Microsoft Security Advisory 2639658 by denying access to the T2EMBED.DLL library. This prevents the vulnerable TrueType parsing code from being invoked but may impact the rendering of some documents and web pages.
- Block untrusted font loading via Group Policy. On systems that support it, enable the "Block untrusted fonts" Group Policy setting to prevent the kernel from processing font files from untrusted locations such as the internet. This significantly reduces the attack surface for font-based kernel exploits.
- Deploy endpoint detection and response (EDR) tools. Install EDR solutions capable of detecting kernel-level exploitation attempts, including suspicious win32k.sys behavior, unexpected kernel-mode code execution patterns, and Duqu-related indicators of compromise. Monitor for crafted Word documents and web pages that attempt to exploit font parsing vulnerabilities.
Technical Details
The CVSS v3.1 vector for CVE-2011-3402 is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a score of 8.8 (High). Attack Vector (AV:N) is network, enabling remote exploitation through malicious documents sent via email or hosted on compromised websites. Attack Complexity (AC:L) is low, indicating reliable exploitation without requiring specific environmental conditions. Privileges Required (PR:N) is none, as no authentication is needed. User Interaction (UI:R) is required, as the victim must open a crafted Word document or navigate to a malicious webpage. Scope (S:U) is unchanged. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high, reflecting complete system compromise.
The vulnerability exists in the TrueType font parsing engine within win32k.sys, the primary kernel-mode driver responsible for Windows graphics and window management. TrueType fonts contain a bytecode instruction set interpreted by the font rasterizer for hinting and rendering. The parsing engine fails to properly validate certain TrueType instructions and table structures, allowing a specially crafted font to trigger kernel memory corruption during the font rendering process. Because win32k.sys operates in Ring 0 (kernel mode), successful exploitation immediately grants the attacker the highest system privileges, bypassing all user-mode security controls. In the Duqu campaign, the exploit was delivered through a Microsoft Word document containing an embedded TrueType font. When the victim opened the document, Word rendered the font, triggering the win32k.sys vulnerability and executing shellcode in kernel context. The shellcode installed the Duqu payload, which functioned as an information-gathering tool designed to collect intelligence for future attacks. The sophistication of the exploit, including its reliable kernel-mode code execution across multiple Windows versions, indicated development by a well-resourced threat actor with deep knowledge of Windows kernel internals.
Frequently Asked Questions
What is CVE-2011-3402 and why is it historically significant?
CVE-2011-3402 is a kernel-level remote code execution vulnerability in the Windows TrueType font parsing engine. It is historically significant because it was exploited by the Duqu malware, which is widely attributed to the same threat actors behind Stuxnet — the malware that sabotaged Iranian nuclear centrifuges. This makes CVE-2011-3402 one of the few publicly known vulnerabilities used in nation-state cyber operations.
How does CVE-2011-3402 achieve kernel-level code execution?
The vulnerability exploits the TrueType font parsing engine in win32k.sys, which runs in kernel mode (Ring 0). When a user opens a document or webpage containing a specially crafted TrueType font, the font rasterizer processes malicious bytecode instructions that corrupt kernel memory, allowing the attacker to execute arbitrary code with the highest system privileges.
Are modern Windows versions affected by CVE-2011-3402?
No, modern Windows versions include significant mitigations against font-based kernel attacks. Microsoft moved font rendering out of the kernel into user-mode processes in later Windows versions, and introduced the "Block untrusted fonts" policy. Windows 10 and 11 are not affected by this specific vulnerability, though font parsing remains an area of ongoing security research.
What was the Duqu malware that exploited CVE-2011-3402?
Duqu was a sophisticated information-gathering malware discovered in 2011 that shared significant code with Stuxnet. It used CVE-2011-3402 as its infection vector through crafted Word documents. Once installed, Duqu collected intelligence about industrial control systems and network infrastructure, likely in preparation for future sabotage operations. The malware was primarily targeted at organizations in the Middle East and Europe.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.