CVE-2015-2426
Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
Description
CVE-2015-2426 is a critical remote code execution vulnerability (CWE-787) in the Microsoft Windows Adobe Type Manager Library that allows an attacker to execute arbitrary code by convincing a user to open a document or visit a web page containing a specially crafted OpenType font. The out-of-bounds write flaw in font parsing enables complete system compromise with the privileges of the current user, or kernel-level access if the font is processed in kernel mode. CISA has confirmed active exploitation and added CVE-2015-2426 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 91.8% (99.9th percentile), this vulnerability represents one of the most critical font-based attack vectors in Windows history.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/(Exploit, Third Party Advisory)
- http://www.kb.cert.org/vuls/id/103336(Third Party Advisory, US Government Resource)
- http://www.securityfocus.com/bid/75951(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032991(Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/38222/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a weakness where software writes data past the end, or before the beginning, of the intended buffer, leading to memory corruption that can enable arbitrary code execution, crashes, or data corruption. In CVE-2015-2426, the Windows Adobe Type Manager Library writes beyond allocated buffer boundaries when parsing a malformed OpenType font, enabling an attacker to corrupt kernel or user-mode memory and achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2015-2426 can be exploited remotely by embedding a malicious OpenType font in a web page, document, or email attachment, requiring only that the victim opens the content. Because the Windows Adobe Type Manager Library historically processed fonts in kernel mode on older Windows versions, successful exploitation could yield kernel-level code execution — bypassing all user-mode security controls including sandboxes and privilege boundaries. Even on systems where font processing occurs in user mode, the attacker gains code execution with the privileges of the current user. Confidentiality, integrity, and availability are all fully compromised, and the 99.9th percentile EPSS score reflects the extreme severity and widespread exploitation of this vulnerability.
Exploit Maturity
CVE-2015-2426 is confirmed as actively exploited in the wild by CISA and is listed in the Known Exploited Vulnerabilities catalog. This vulnerability was notably exposed as part of the Hacking Team data breach in July 2015, where it was found among the company's stockpile of zero-day exploits. The EPSS score of 91.8% (99.9th percentile) reflects near-certain exploitation activity. The availability of detailed exploit information from the Hacking Team leak significantly accelerated the development of weaponized exploits by additional threat actors.
Remediation
- Apply the Microsoft security update MS15-078 (July 2015) as an emergency out-of-band patch for CVE-2015-2426 on all affected Windows systems.
- On Windows 8 and later, verify that font processing has been moved from kernel mode to user mode by ensuring the system is fully updated, which reduces the impact of font-based exploits.
- Consider disabling the WebClient service and restricting the loading of OpenType fonts from untrusted sources via Group Policy as a defense-in-depth measure.
- Deploy email and web content filtering to detect and block documents containing embedded malicious fonts before they reach end users.
- Monitor endpoints for indicators of compromise related to font parsing exploitation, including unexpected crashes in the Windows Font Cache Service or anomalous kernel activity during document rendering.
Technical Details
CVE-2015-2426 is an out-of-bounds write vulnerability (CWE-787) in the Windows Adobe Type Manager Library (ATMFD.DLL), which handles OpenType and PostScript font rendering on Windows systems. The flaw occurs during the parsing of a specially crafted OpenType font, where a malformed font table causes the library to write data beyond the allocated buffer boundaries in memory. On Windows versions prior to Windows 8, ATMFD.DLL operated in kernel mode, meaning successful exploitation achieved ring 0 code execution and complete system compromise. On Windows 8 and later, font processing was moved to user mode, reducing the impact to code execution with the current user's privileges. The vulnerability was discovered in the Hacking Team data breach and was patched as an emergency out-of-band update by Microsoft in July 2015.
Frequently Asked Questions
Is CVE-2015-2426 being actively exploited?
Yes. CVE-2015-2426 is confirmed as actively exploited and is listed in the CISA KEV catalog. The vulnerability was discovered among the Hacking Team's arsenal of zero-day exploits during the July 2015 data breach, and the EPSS score of 91.8% (99.9th percentile) reflects widespread exploitation.
What products are affected by CVE-2015-2426?
CVE-2015-2426 affects the Windows Adobe Type Manager Library (ATMFD.DLL) across all supported Windows versions at the time of disclosure, including Windows Vista, Windows 7, Windows 8/8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows RT.
How do I fix CVE-2015-2426?
Apply the Microsoft emergency security update MS15-078 (July 2015) on all affected systems. This was released as an out-of-band patch due to the severity of active exploitation. Ensure systems are running Windows 8 or later where font processing occurs in user mode rather than kernel mode.
How severe is CVE-2015-2426?
CVE-2015-2426 is rated CRITICAL and can achieve kernel-level code execution on older Windows versions through a malicious font. The 99.9th percentile EPSS score, its origin in the Hacking Team zero-day arsenal, and CISA KEV listing make this one of the most critical font-based vulnerabilities in Windows history.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.