CVE-2015-2426
Published: 20 July 2015
Summary
CVE-2015-2426 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Deeper analysis
The vulnerability CVE-2015-2426 is a buffer underflow in atmfd.dll within the Windows Adobe Type Manager Library, affecting Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1. It is triggered by a crafted OpenType font and is also known as the OpenType Font Driver Vulnerability. This issue is classified under CWE-119 and CWE-124 with a CVSS score of 8.8.
Remote attackers can exploit the flaw by delivering a malicious OpenType font to a target system, potentially achieving arbitrary code execution. The attack vector is network-based and requires user interaction, such as rendering the font in an affected application.
Microsoft addressed the issue in security bulletin MS15-078. Additional analysis from sources like Trend Micro links the vulnerability to disclosures from the Hacking Team leak, highlighting its potential use in targeted attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-2519
Vulnerability details
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…
more
and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the MS15-078 security update that removes the buffer underflow in atmfd.dll before a crafted OpenType font can be processed.
Malicious-code protection mechanisms can inspect or block documents and web content carrying the crafted OpenType font before the vulnerable font driver is invoked.
Integrity verification of system libraries and font files can detect or reject unauthorized or tampered OpenType fonts that would trigger the atmfd.dll flaw.