{"schemaVersion":3,"id":"CVE-2015-2426","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","description":"Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka \"OpenType Font Driver Vulnerability.\"","dates":{"published":"2015-07-20T18:00:00.000Z","modified":"2025-10-21T23:55:58.633Z","reserved":null,"kevAdded":["2022-03-28T00:00:00.000Z"],"kevDue":["2022-04-18T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.86576,"percentile":0.99739,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.86576},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.8669,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.8669,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.8669,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.8669,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.86576,"percentile":0.99739}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.86576,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.86576,"percentile":0.99739}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-28T00:00:00.000Z","dueDate":"2022-04-18T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-2426","label":"nvd.nist.gov/vuln/detail/CVE-2015-2426"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-28T00:00:00.000Z","dueDate":"2022-04-18T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-2426","label":"nvd.nist.gov/vuln/detail/CVE-2015-2426"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_3659228EA541C1A6","name":"Exploit Reference (blog.trendmicro.com)","source":"reference","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"38222","name":"Microsoft Windows - Font Driver Buffer Overflow (MS15-078) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/38222","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows_x86-64"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows_x86-64","file":"exploits/windows_x86-64/local/38222.rb","codes":["CVE-2015-2433","CVE-2015-2426","OSVDB-125679","OSVDB-125000","MS15-078"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_LOCAL_MS15_078_ATMFD_BOF","name":"MS15-078 Microsoft Windows Font Driver Buffer Overflow","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/local/ms15_078_atmfd_bof.rb","maturity":"poc","reliabilityScore":0,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/local/ms15_078_atmfd_bof","rank":"0","rankName":"manual","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":3,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"},{"id":"CWE-124","name":"Buffer Underwrite ('Buffer Underflow')","description":"The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/124.html"}],"affected":[{"vendor":"microsoft","product":"windows_10","name":"windows 10","label":"windows_10","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_10"},{"vendor":"microsoft","product":"windows_7","name":"windows 7","label":"windows_7","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_7"},{"vendor":"microsoft","product":"windows_8","name":"windows 8","label":"windows_8","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_8"},{"vendor":"microsoft","product":"windows_8.1","name":"windows 8.1","label":"windows_8.1","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_81"},{"vendor":"microsoft","product":"windows_rt","name":"windows rt","label":"windows_rt","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_rt"},{"vendor":"microsoft","product":"windows_rt_8.1","name":"windows rt 8.1","label":"windows_rt_8.1","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_rt_81"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2:sp1","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"},{"vendor":"microsoft","product":"windows_server_2012","name":"windows server 2012","label":"windows_server_2012","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2","eol":null,"hubHref":"/vendor/microsoft/windows_server_2012"},{"vendor":"microsoft","product":"windows_vista","name":"windows vista","label":"windows_vista","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_vista"}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1032991","label":"www.securitytracker.com/id/1032991","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/103336","label":"www.kb.cert.org/vuls/id/103336","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/","label":"blog.trendmicro.com/trendlabs-security-intelligence/…","hostname":"blog.trendmicro.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"https://www.exploit-db.com/exploits/38222/","label":"www.exploit-db.com/exploits/38222/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/75951","label":"www.securityfocus.com/bid/75951","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2015-07-20T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-28T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-04-18T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:58.633Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:26:04.503Z","stale":false,"partial":false}}