cbcvebase.
CVE-2015-2462
published 2015-08-15

CVE-2015-2462: ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1…

PriorityP271critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
35.56%
98.3th percentile
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."

Affected

10 ranges
VendorProductVersion rangeFixed in
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftwindows_server_2008——
microsoftwindows_server_2012——

Detection & IOCsextracted from sources · hover to see the quote

filenameATMFD.DLL↗
urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37916.zip↗
  • →Crash/exploit is triggered via a crafted OTF font file with a malformed FDSelect offset in the CFF table Top DICT (key '12 37'). Monitor for kernel bugcheck 0xD5 (DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL) with ATMFD.DLL listed as the faulting driver. ↗
  • →The faulting instruction is a byte-read at ATMFD+0xbf53 (mov bl,byte ptr [eax]). On 32-bit Windows, the controlled FDSelect offset can be set to point into kernel space, making the bug reliably reproducible and potentially exploitable for kernel memory disclosure. ↗
  • →The exploit path runs through win32k font-rendering syscalls: NtGdiGetFontUnicodeRanges → GreGetFontUnicodeRanges → RFONTOBJ::bRealizeFont → PDEVOBJ::QueryFontData → ATMFD. Monitor for unusual NtGdiGetFontUnicodeRanges calls from non-UI processes or from processes loading untrusted OTF fonts. ↗
  • ·The out-of-bounds read via a malformed FDSelect offset is only reliably exploitable (reaching kernel address space) on 32-bit Windows. On 64-bit platforms the controlled offset stays within user-space and ATMFD's own exception handler catches it, significantly reducing exploitability. ↗
  • ·At time of disclosure, researchers assessed the bug as limited to remote DoS or local kernel memory disclosure, but could not fully rule out higher-severity impact from additional ATMFD logic. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.