CVE-2015-2387highunder attackCWE-787

CVE-2015-2387

Published · Updated

Follow this CVE+ Monitor ATM Font Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 35%
from disclosure to weapon1853 days
Published on NVDJul 14
1st PoC+1853d
CISA KEV+2424d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT28🇷🇺 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A flaw in Windows' font handling system (ATMFD.DLL) allows a local user to run malicious code with higher privileges by opening a specially crafted file. This is dangerous because an attacker with basic access can take complete control of the computer.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in the Adobe Type Manager Font Driver (ATMFD.DLL) across multiple Windows versions. Local attackers can trigger memory corruption by executing a malicious application, achieving privilege escalation from standard user to system level without user interaction beyond running the crafted executable.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.