High severity8.8CISA KEVNVD Advisory· Published Nov 4, 2011· Updated Apr 22, 2026
CVE-2011-3402
CVE-2011-3402
Description
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Affected products
9- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
21- blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspxnvdVendor Advisory
- isc.sans.edu/diary/Duqu+Mitigation/11950nvdThird Party Advisory
- secunia.com/advisories/49121nvdVendor Advisory
- secunia.com/advisories/49122nvdVendor Advisory
- technet.microsoft.com/security/advisory/2639658nvdVendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087nvdVendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034nvdVendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039nvdVendor Advisory
- blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-filesnvdBroken Link
- www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_TwonvdNot Applicable
- www.securitytracker.com/idnvdBroken Link
- www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploitnvdNot Applicable
- www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdfnvdNot Applicable
- www.us-cert.gov/cas/techalerts/TA11-347A.htmlnvdUS Government Resource
- www.us-cert.gov/cas/techalerts/TA12-129A.htmlnvdUS Government Resource
- www.us-cert.gov/cas/techalerts/TA12-164A.htmlnvdUS Government Resource
- www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdfnvdUS Government Resource
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998nvdBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290nvdBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645nvdBroken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.