⚠ Actively exploited
Added to CISA KEV on 2022-05-25. Federal agencies required to patch by 2022-06-15. Required action: Apply updates per vendor instructions..

CVE-2016-7256 — Improper Access Control in Microsoft Windows Server 2008

CWE-284 — Improper Access Control7 documents6 sources
Severity
8.8HIGHNVD
EPSS
64.7%
top 1.53%
CISA KEV
KEV
Added 2022-05-25
Due 2022-06-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
15
Microsoft Windows Server 2008Microsoft Windows Server 2012Msrc Windows 10+12 more
Timeline
PublishedNov 10
KEV addedMay 25
KEV dueJun 15
CISA Required Action: Apply updates per vendor instructions.

Description

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Open Type Font Remote Code Execution Vulnerability."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages14 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cx4j-72f6-rmxr: atmfd↗2022-05-14
▶
VulnCheck
Microsoft Windows Open Type Font Remote Code Execution Vulnerability↗2016
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Open Type Font Remote Code Execution Vulnerability↗2022-05-25
▶
Microsoft
Microsoft Graphics Remote Code Execution Vulnerability↗2016-11-08
▶

🕵️Threat Intelligence

2
Qualys
Patch Tuesday: Microsoft Patches Actively Exploited Kernel and OpenType Font, Three Previously Disclosed Browser Issues and SQL Server | Qualys↗2016-11-08
▶
Qualys
Patch Tuesday: Microsoft Patches Actively Exploited Kernel and OpenType Font, Three Previously Disclosed Browser Issues and SQL Server↗2016-11-08
▶