Vulnerability record · CVE-2011-3402 · published 4 November 2011
CVE-2011-3402: Microsoft Windows TrueType Font Parsing Remote Code Execution
Microsoft · Windows 7
The TrueType font parsing engine in win32k.sys on multiple Windows versions fails to properly handle crafted font data, allowing remote code execution. The flaw was exploited in the wild in November 2011 by the Duqu malware, making it a high-impact kernel-level vulnerability.
Description
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityThe vulnerability is actively exploited in the wild, listed in CISA KEV, and has a very high EPSS score, posing an immediate risk to unpatched systems.
What it is
The TrueType font parsing engine in win32k.sys on multiple Windows versions fails to properly handle crafted font data, allowing remote code execution. The flaw was exploited in the wild in November 2011 by the Duqu malware, making it a high-impact kernel-level vulnerability.
Impact
An attacker can execute arbitrary code in kernel mode, gaining full control of the affected system. This could lead to installation of malware, data theft, or further lateral movement.
Attack surface
The vulnerability is reached remotely via a crafted font embedded in a Word document or web page. User interaction is required to open the document or visit the page, and no authentication is needed.
Exploitation
The vulnerability is listed in CISA KEV with a due date of 2025-10-27, and EPSS indicates a 78.3% probability of exploitation in the next 30 days. It was actively exploited in the wild by Duqu in 2011.
What to do
- Apply the vendor patches referenced in Microsoft Security Bulletins MS11-087, MS12-034, and MS12-039.
- Disable or restrict the parsing of embedded fonts in documents and web content where feasible.
- Follow CISA BOD 22-01 guidance for cloud services and apply mitigations per vendor instructions.
- Consider discontinuing use of affected Windows versions if patches cannot be applied.
- Implement network-level filtering to block malicious font files from untrusted sources.
Detection
- Monitor for process creation events involving win32k.sys or font-related processes with unusual parent-child relationships.
- Hunt for Word documents or web pages containing embedded TrueType fonts that trigger memory corruption patterns.
- Use endpoint detection to identify attempts to exploit kernel font parsing, such as unexpected crashes in win32k.sys.
- Review logs for Duqu-related indicators of compromise, including specific file names or registry keys.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2011-3402 to the Known Exploited Vulnerabilities catalog on 6 October 2025 as "Microsoft Windows Remote Code Execution Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 27 October 2025.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-3402 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-3402), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
