PT-2015-1569 · Microsoft+1 · Windows+1

Cedric Halbronn + 2 · Published 2015-07-20 · Updated 2025-04-07 · CVE-2015-2426

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Adobe Type Manager Library versions prior to the fixed version

Description The issue is caused by a buffer underflow in the atmfd.dll library, allowing remote attackers to execute arbitrary code via a crafted OpenType font. This could enable an attacker to take complete control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows Adobe Type Manager Library, update to a version that fixes the buffer underflow issue in atmfd.dll to prevent remote code execution. As a temporary workaround, consider restricting the use of specially crafted OpenType fonts until a patch is available. Avoid using the Windows Adobe Type Manager Library with untrusted font sources until the issue is resolved.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-124

CWE-119

Related Identifiers

BDU:2015-10882

CVE-2015-2426

Affected Products

Type Manager Library

Windows

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms15_078_atmfd_bof.rb · Exploit
• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak · Exploit
• 🔥 https://exploit-db.com/exploits/38222 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2426 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2426 · Security Note
• https://bdu.fstec.ru/vul/2015-10882 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cvenotify/110680 · Telegram Post
• http://technet.microsoft.com/security/bulletin/MS15-078 · Note
• http://kb.cert.org/vuls/id/103336 · Note
• http://technet.microsoft.com/security/bulletin/ms15-078 · Note
• https://t.me/cvenotify/107815 · Telegram Post
• http://securitytracker.com/id/1032991 · Note