Microsoft Windows Remote Code Execution Vulnerability

Timeline

Detection, updates, and resolution for this record.

1. Nov 4, 2011 · Catalog

   Detected

   Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by

2. Oct 6, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Oct 27, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by

Affected

• cpe microsoft/windows 7version unspecified
• cpe microsoft/windows server 2003version unspecified
• cpe microsoft/windows server 2008version unspecified
• cpe microsoft/windows vistaversion unspecified
• cpe microsoft/windows xpversion unspecified
• vendor Microsoft Windowsversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2011-3402

  Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

  cisa.gov
• CVE.orgVulnerability recordCVE-2011-3402

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2011-3402

  30-day exploitation probability 78.1%

  first.org
• Metasploit ModulesPublic exploit modulepost_windows/gather/forensics/duqu_check

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2011-3402

  Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to e

  nvd.nist.gov

References

• Vendor Advisory · blogs.technet.com
• Vendor Advisory · secunia.com
• Vendor Advisory · secunia.com
• Vendor Advisory · technet.microsoft.com
• CISA note · docs.microsoft.com
• Vendor Advisory · docs.microsoft.com
• Vendor Advisory · docs.microsoft.com
• CISA note · nvd.nist.gov