CVE-2016-7256: Windows atmfd.dll OpenType Font Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote code execution with no privileges required, high EPSS, and confirmed inclusion in CISA KEV make this an urgent patch target despite the user-interaction requirement.

What it is

The Windows font library (atmfd.dll) mishandles crafted OpenType fonts, allowing remote code execution. An attacker can host a malicious font on a web page and trigger the flaw when a victim views it, making this a browser-reachable code execution issue affecting a broad set of Windows versions.

Impact

An attacker gains arbitrary code execution in the context of the affected process, typically the user's session, enabling full compromise of confidentiality, integrity and availability on the host.

Attack surface

Reached over the network via a crafted web site that loads a malicious OpenType font; no authentication is required but user interaction (visiting the page) is needed per the CVSS vector AV:N/PR:N/UI:R.

Exploitation

Listed in CISA KEV since 2022-05-25 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.648 (99.2nd percentile), indicating high likelihood of exploitation activity; no ransomware campaign use is documented.

What to do

• Apply the Microsoft MS16-132 security update to all affected Windows versions (Vista SP2, Server 2008 SP2/R2 SP1, 7 SP1, 8.1, Server 2012/R2, RT 8.1, Windows 10 Gold/1511/1607, Server 2016).
• Prioritize patching internet-facing and user-workstation systems, since exploitation requires only a user visiting a malicious page.
• Enforce browser and email client controls that block or prompt on untrusted font embedding where feasible.
• Restrict or monitor access to untrusted web content on systems that cannot be patched promptly.

Detection

• Monitor for unexpected crashes or faults in atmfd.dll and related font-parsing processes (e.g., browser, font host) via endpoint telemetry.
• Hunt for processes loading atmfd.dll that subsequently spawn child processes or make unusual network connections, a common post-exploitation pattern.
• Review web proxy and DNS logs for access to known malicious or suspicious font-hosting domains, correlating with endpoint alerts.
• Check patch compliance reporting for MS16-132 across the affected Windows builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.