CVE-2011-3402 in Windows
Summary
by MITRE
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability described in CVE-2011-3402 represents a critical flaw in Microsoft Windows kernel-mode drivers that affects the TrueType font parsing engine within win32k.sys. This vulnerability specifically targets the rendering engine responsible for processing font data in Windows operating systems, making it a prime target for exploitation in remote code execution scenarios. The affected systems include a broad range of Windows versions from XP SP2 and SP3 through Windows 7 SP1, encompassing both client and server operating systems. The vulnerability's exploitation pathway demonstrates the inherent risks associated with font processing in operating system kernels, where maliciously crafted font data can trigger memory corruption and arbitrary code execution.
The technical nature of this vulnerability stems from improper input validation and memory handling within the TrueType font parsing routines implemented in the win32k.sys kernel driver. When Windows processes a maliciously crafted font file embedded within Word documents or delivered through web pages, the parsing engine fails to properly validate the font structure, leading to buffer overflows or other memory corruption conditions. This flaw operates at the kernel level, meaning that successful exploitation can result in complete system compromise without requiring user interaction beyond opening the malicious document or visiting the compromised webpage. The vulnerability's exploitation requires no special privileges and can be executed remotely, making it particularly dangerous in enterprise environments where users may encounter malicious documents or web content.
The operational impact of CVE-2011-3402 was demonstrated through its use in the Duqu malware campaign in November 2011, which marked the first known exploitation of this vulnerability in the wild. This attack vector highlighted how font parsing vulnerabilities can serve as sophisticated initial access mechanisms for advanced persistent threats, as they allow attackers to bypass traditional security controls and gain system-level privileges. The vulnerability's exploitation in Duqu showcased the potential for creating stealthy, persistent threats that can establish backdoors, exfiltrate data, and maintain long-term access to compromised systems. The widespread nature of affected Windows versions meant that organizations across various sectors were potentially vulnerable, leading to significant security implications for both enterprise and consumer environments.
Mitigation strategies for CVE-2011-3402 primarily focus on applying the relevant Microsoft security patches that address the kernel-mode font parsing vulnerability. Organizations should prioritize immediate deployment of the Windows security updates released by Microsoft to remediate the vulnerability. Additional defensive measures include implementing application whitelisting policies to restrict execution of potentially malicious documents, configuring web browsers with enhanced security settings to prevent automatic font rendering, and deploying intrusion detection systems to monitor for exploitation attempts. Network segmentation and email filtering solutions can help reduce the attack surface by blocking malicious documents before they reach end users. The vulnerability also underscores the importance of maintaining updated security practices and conducting regular vulnerability assessments to identify and remediate similar kernel-level flaws. This case study exemplifies how low-level operating system vulnerabilities can have far-reaching consequences and emphasizes the need for comprehensive security approaches that address both application-layer and kernel-mode security controls. The vulnerability aligns with CWE-125, which describes out-of-bounds read conditions, and can be categorized under ATT&CK technique T1059.007 for command and scripting interpreter, as exploitation typically involves executing malicious code through compromised system processes.