Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,…

published 2015-07-20 11y ago modified 2026-06-17 4mo ago also EUVD-2015-2519

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-28
epss: 86.6%; EPSS 86.6% chance of exploitation in 30 days, percentile 99.7%
public exploits: 2; Metasploit and Exploit-DB

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

links 1

docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078 advisory

Is CVE-2015-2426 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2015-07-05 Found exploited as a 0-day (Project Zero)
2015-07-11 First public exploit (Metasploit exploit/windows/local/ms15_078_atmfd_bof)
2015-07-20 0-day patched (Project Zero)
2015-07-20 Published
2022-03-28 Added to CISA KEV
2022-04-18 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-03-28)
Patch by: 2022-04-18 (4y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Windows
CISA name: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found: 2015-07-05
Patched: 2015-07-20
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: last yr. (2025-02-10)

Exploit prediction

86.58% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/local/ms15_078_atmfd_bof MS15-078 Microsoft Windows Font Driver Buffer Overflow metasploit exploit, manual rank, 2015-07-11
EDB-38222 Microsoft Windows - Font Driver Buffer Overflow (MS15-078) (Metasploit) local, 2015-09-17
blog.trendmicro.com http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-124 Buffer Underwrite
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2015/ms15-078
vendor-advisory, patch
exploit-db.com /exploits/38222/
exploit, third-party-advisory, vdb-entry
blog.trendmicro.com /trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak
exploit, third-party-advisory
securitytracker.com /id/1032991
vdb-entry, third-party-advisory
kb.cert.org /vuls/id/103336
third-party-advisory, us-government-resource
securityfocus.com /bid/75951
vdb-entry, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2426
government-resource, us-government-resource

Sources

CVE List CVE-2015-2426
NVD CVE-2015-2426

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed