CVE-2015-2387KEV · OVERDUE

Microsoft ATM Font Driver Privilege Escalation Vulnerability

High · published July 14, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.4th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
7.8
EPSS
35%
Percentile
98.4
In the wild
Confirmed
What it is

🚨 A crafted application can allow local users to gain elevated privileges like a magician pulling a rabbit out of a hat! 🎩 Think of this vulnerability as a sneaky access door in a hotel where guests can wander into restricted areas without a keycard. If they successfully get through, they can access the VIP lounge and more! An attacker could exploit this vulnerability to gain administrative privileges on affected systems, opening the door to devastating actions such as installing malicious software or stealing sensitive information. This is particularly alarming since it affects core components of multiple Windows versions, making it a prime target for bad actors!

Put simply

Think of this vulnerability as a sneaky access door in a hotel where guests can wander into restricted areas without a keycard. If they successfully get through, they can access the VIP lounge and more! The ATMFD.DLL memory corruption vulnerability allows local users to execute malicious code with elevated privileges by exploiting flaws in the Adobe Type Manager Font Driver. This can lead to unauthorized actions that compromise system integrity.

What to do

An attacker could exploit this vulnerability to gain administrative privileges on affected systems, opening the door to devastating actions such as installing malicious software or stealing sensitive information. This is particularly alarming since it affects core components of multiple Windows versions, making it a prime target for bad actors! To secure your systems, ensure that you patch to the latest updates provided by Microsoft for all affected versions. Additionally, review user permissions and restrict local access where possible to mitigate the risk of exploitation. Regularly monitor for unusual activity as well! You've got this! Follow these steps and you'll be on your way to securing your environment like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.34878 · 98.4th percentile
Published
2015-07-14T22:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 14 JUL 22:00Z
    ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1…
    cvelistv5