CVE-2015-2464

published 2015-08-15

CVE-2015-2464: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and…

Priority P2 71 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2463.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
microsoft	live_meeting	—	—
microsoft	lync	—	—
microsoft	lync	—	—
microsoft	lync_basic	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	net_framework	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	silverlight	<= 5.1.40416.0	—
microsoft	windows_server_2008	—	—
microsoft	windows_server_2012	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37914.zip↗

process csrss.exe↗

other win32k!fsc_BLTHoriz+0x37↗

• → Crash triggered in win32k!fsc_BLTHoriz (32-bit Windows 7), win32k!fsc_MeasureGlyph (64-bit Windows 7), or win32k!fsg_CopyFontProgramResults (32-bit Windows 8) during TTF font processing — monitor for kernel bugcheck 0xD6 (DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION) originating from win32k.sys ↗
• → Malicious TTF font files exploit mutations in the 'fpgm', 'hmtx', and 'maxp' tables — inspect embedded or loaded TrueType fonts for anomalies in these specific tables ↗
• → Crash manifests as an out-of-bounds pool write (write operation, Arg2=1) — look for pool corruption events in win32k.sys associated with font rendering ↗
• → Enable Special Pools for win32k.sys to reliably detect exploitation attempts in a controlled/lab environment — crash will occur immediately upon triggering the bug ↗

• · The vulnerability affects a wide range of Windows versions and Microsoft products; crash location in win32k.sys differs by OS architecture — detections must account for all three crash sites ↗
• · On default (non-Special Pool) Windows installations, the crash may manifest in win32k!fsc_RemoveDups or other kernel locations rather than the primary crash site, making consistent detection harder ↗
• · Reproduction may require a custom program that displays all font glyphs at various point sizes — passive file scanning alone may be insufficient to trigger or detect the vulnerability ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20