CVE-2015-2387: Microsoft Windows ATMFD.DLL out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation with a KEV listing and high EPSS percentile, but exploitation requires an existing local foothold and the affected platforms are largely legacy.

What it is

The Adobe Type Manager Font Driver (ATMFD.DLL) in multiple Windows versions contains an out-of-bounds write (CWE-787) that a local user can trigger with a crafted application. Successful exploitation corrupts memory and lets the attacker escalate from a normal user context to higher privileges on the host. It matters because the affected platforms are legacy but still deployed, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who can run code locally gains elevated privileges on the Windows host, typically SYSTEM or kernel-level access. That foothold enables further actions such as disabling security controls, persisting, or moving laterally.

Attack surface

The vector is local (AV:L) with low attack complexity, low privileges required, and no user interaction, so any process already running as a standard user can reach the vulnerable driver. No remote or network path is described in the record.

Exploitation

CVE-2015-2387 is in CISA's KEV catalog (added 2022-03-03, due 2022-03-24), indicating known exploitation in the wild; EPSS gives a 30-day probability of 0.3512 (98.4th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft MS15-077 update for all affected Windows versions; this is the primary fix.
• Retire or isolate unsupported platforms (Windows Server 2003, Vista, RT) that cannot receive the patch.
• Restrict local interactive and code-execution access to trusted users on affected hosts.
• Monitor and constrain use of the ATMFD font driver where feasible, and disable it if the environment does not require it.
• Track KEV remediation deadlines and verify patched status across the estate.

Detection

• Alert on unexpected processes loading or writing to ATMFD.DLL and on font-driver crashes in Windows event logs.
• Hunt for privilege-escalation behavior: standard-user processes spawning SYSTEM-level children or writing to protected system paths.
• Correlate local exploit artifacts (crafted font files, unusual driver load events) with subsequent high-integrity process creation.
• Review hosts still running the listed legacy Windows versions and confirm patch state against MS15-077.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.