{"id":"CVE-2011-3402","kind":"vulnerability","aliases":["CVE-2011-3402"],"related":[],"title":"Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft…","description":"Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka \"TrueType Font Parsing Vulnerability.\"","summary":"A flaw in the TrueType font parser inside the Windows kernel driver win32k.sys lets crafted font data run code. An attacker gets code execution on the machine when a user opens a crafted Word document or visits a crafted web page.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2025-10-06T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2003","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows vista","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows xp","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","microsoft-office","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2011-3402 (MS11-087); the sources do not give a KB number, so confirm it against Microsoft's bulletin.\nFollow CISA's KEV guidance: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2011-11-04T21:55:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:37+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:44:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2011-3402 (MS11-087); the sources do not give a KB number, so confirm it against Microsoft's bulletin.\nFollow CISA's KEV guidance: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.","reach":"internet","summary":"A flaw in the TrueType font parser inside the Windows kernel driver win32k.sys lets crafted font data run code. An attacker gets code execution on the machine when a user opens a crafted Word document or visits a crafted web page.","category":"infrastructure","who_cares":["windows","microsoft-office","internet-explorer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code with kernel privileges on the victim's Windows machine.","analyst_note":"Confirm the exact patch (MS11-087, KB numbers per Windows version) and a reliable detection method at Microsoft's bulletin and the NVD entry for CVE-2011-3402.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2563,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2011':20A,23A '-3402':21A,24A '2003':33A,119C '2008':37A,126C '2011':163C '7':29A,134C 'aka':166C 'allow':138C 'arbitrari':143C 'attack':73B,140C 'code':71B,75B,144C 'craft':67B,85B,91B,146C 'cve':19A,22A 'data':69B,148C 'document':87B,152C 'driver':16A,64B,109C 'duqu':165C 'engin':8A,101C 'execut':76B,142C 'exploit':44B,157C 'explor':48B 'flaw':54B 'font':6A,58B,68B,99C,147C,168C 'get':74B 'gold':135C 'infrastructur':45B 'insid':60B 'internet':47B 'internet-explor':46B 'kernel':14A,63B,107C 'kernel-mod':13A,106C 'let':66B 'machin':79B 'microsoft':18A,25A,27A,30A,34A,38A,41A,50B,111C 'microsoft-offic':49B 'mode':15A,108C 'novemb':162C 'offic':51B 'open':83B 'page':93B,155C 'pars':7A,100C,169C 'parser':59B 'r2':128C,130C 'remot':139C 'run':70B 'server':32A,36A,118C,125C 'sp1':131C,137C 'sp2':114C,120C,123C,127C 'sp3':116C 'truetyp':5A,57B,98C,167C 'unspecifi':1A,94C 'user':82B 'via':145C 'visit':89B 'vista':40A,122C 'vulner':2A,95C,170C 'web':92B,154C 'wild':160C 'win32k.sys':10A,65B,103C 'window':52B,62B,112C,117C,121C,124C,133C 'windows':26A,28A,31A,35A,39A,42A 'word':86B,151C 'xp':43A,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2011-11-04T21:55:04+00:00","kev":{"dateAdded":"2025-10-06","dueDate":"2025-10-27","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2011-3402","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-3402","severity":null,"published_at":"2025-10-06T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2011-3402","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3402","severity":null,"published_at":"2011-11-04T21:55:04+00:00","modified_at":"2026-06-16T23:33:14+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}