Vulnerability record · CVE-2009-2514 · published 11 November 2009
CVE-2009-2514: Windows win32k EOT font parsing code execution
Microsoft · Windows 2000
win32k.sys in the Windows kernel fails to correctly parse font code while building a directory-entry table, allowing a crafted Embedded OpenType (EOT) font to corrupt memory. Because the flaw sits in the kernel font parser, successful exploitation yields code execution at kernel privilege on affected Windows 2000, XP, and Server 2003 systems.
Description
win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka "Win32k EOT Parsing Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityKernel-level remote code execution with a CVSS 2.0 base score of 9.3 and very high EPSS percentile, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
win32k.sys in the Windows kernel fails to correctly parse font code while building a directory-entry table, allowing a crafted Embedded OpenType (EOT) font to corrupt memory. Because the flaw sits in the kernel font parser, successful exploitation yields code execution at kernel privilege on affected Windows 2000, XP, and Server 2003 systems.
Impact
An attacker gains arbitrary code execution in kernel context, which typically means full control of the affected machine, including the ability to install programs, alter data, or create accounts with full rights.
Attack surface
The vector is network-reachable with medium attack complexity and no authentication (AV:N/AC:M/Au:N), consistent with delivering a malicious EOT font to a victim, for example through a web page or document that triggers font parsing. User interaction is not stated in the record but is implied by the delivery model; the description does not specify the exact trigger.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded. EPSS is high (0.47489, 98.8th percentile), indicating elevated predicted exploitation activity, but the record contains no reference tagged as exploit code or in-the-wild use.
What to do
- Apply Microsoft security bulletin MS09-065 (the vendor fix for this vulnerability) to all affected Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2 systems.
- Retire or isolate unsupported Windows 2000 and XP hosts, since they no longer receive security updates.
- Restrict or block untrusted EOT font files at email and web gateways where feasible.
- Limit browsing and document opening by users on legacy systems to trusted sources.
- Monitor vendor and US-CERT advisories for updated guidance on this and related font-parsing flaws.
Detection
- Hunt for unexpected win32k.sys crashes or font-parsing faults in system and application event logs on legacy Windows hosts.
- Monitor for processes loading or writing unusual .eot font files, especially from email attachments or web downloads.
- Correlate suspicious font file creation with subsequent process creation or privilege escalation activity on affected systems.
- Use the CISE OVAL definition (oval:org.mitre.oval:def:6406) to scan for unpatched hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-2514 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-2514), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
