Microsoft Windows Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-10-06
• EPSS: 78% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

CISA: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 27 Oct 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-th…Broken Link
• blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-263965…Vendor Advisory
• isc.sans.edu/diary/Duqu+Mitigation/11950Third Party Advisory
• secunia.com/advisories/49121Vendor Advisory
• secunia.com/advisories/49122Vendor Advisory
• technet.microsoft.com/security/advisory/2639658Vendor Advisory
• www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_TwoNot Applicable
• www.securitytracker.com/idBroken Link
• www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploitNot Applicable
• www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_…Not Applicable
• www.us-cert.gov/cas/techalerts/TA11-347A.htmlUS Government Resource
• www.us-cert.gov/cas/techalerts/TA12-129A.htmlUS Government Resource
• www.us-cert.gov/cas/techalerts/TA12-164A.htmlUS Government Resource
• www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdfUS Government Resource
• docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087Vendor Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034Vendor Advisory
• docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039Vendor Advisory
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998Broken Link
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290Broken Link
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource