Actively exploited · Published Jul 20, 2015 · Assigned by microsoft

CVE-2015-2426

High 8.8 Exploited

In plain English

A high-severity security flaw in Windows from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 86.6% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)86.6%top 0.3% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-124 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

1032991 vdb-entry, x_refsource_SECTRACK
VU#103336 third-party-advisory, x_refsource_CERT-VN
http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/ x_refsource_MISC
MS15-078 vendor-advisory, x_refsource_MS
38222 exploit, x_refsource_EXPLOIT-DB
75951 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426 government-resource