Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3,…

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2011-11-04 Published
2. 2025-10-04 CISA SSVC: exploitation active
3. 2025-10-06 Added to CISA KEV
4. 2025-10-27 CISA patch deadline

Added

13 mo ago (2025-10-06)

Patch by

2025-10-27 (12 mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

Microsoft, Windows

CISA name

Microsoft Windows Remote Code Execution Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

13 mo ago (2025-10-04)

78.14% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit post/windows/gather/forensics/duqu_check Windows Gather Forensics Duqu Registry Check metasploit post, normal rank

• docs.microsoft.com /en-us/security-updates/securitybulletins/2011/ms11-087

  vendor-advisory

• docs.microsoft.com /en-us/security-updates/securitybulletins/2012/ms12-034

  vendor-advisory

• docs.microsoft.com /en-us/security-updates/securitybulletins/2012/ms12-039

  vendor-advisory

• secunia.com /advisories/49121

  third-party-advisory, vendor-advisory

• secunia.com /advisories/49122

  third-party-advisory, vendor-advisory

• technet.microsoft.com /security/advisory/2639658

  vendor-advisory

• blogs.technet.com /b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx

  vendor-advisory

• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645

  vdb-entry, signature, broken-link

• us-cert.gov /cas/techalerts/TA12-164A.html

  third-party-advisory, us-government-resource

• blogs.mcafee.com /mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files

  broken-link

• securitytracker.com /id?1027039

  vdb-entry, broken-link

• symantec.com /content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

  not-applicable

• us-cert.gov /cas/techalerts/TA11-347A.html

  third-party-advisory, us-government-resource

• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998

  vdb-entry, signature, broken-link

• us-cert.gov /control_systems/pdf/ICS-ALERT-11-291-01E.pdf

  us-government-resource

• securelist.com /en/blog/208193197/The_Mystery_of_Duqu_Part_Two

  not-applicable

• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290

  vdb-entry, signature, broken-link

• isc.sans.edu /diary/Duqu+Mitigation/11950

  third-party-advisory

• symantec.com /connect/w32-duqu_status-updates_installer-zero-day-exploit

  not-applicable

• us-cert.gov /cas/techalerts/TA12-129A.html

  third-party-advisory, us-government-resource

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3402

  government-resource, us-government-resource

• CVE List CVE-2011-3402
• NVD CVE-2011-3402

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.