CVE-2015-2387

microsoft windows 7, microsoft windows 8, microsoft windows 8.1

Published 14 Jul 2015 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 24 Mar 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability."

References

www.securityfocus.com/bid/75587 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1032908 · Broken Link, Third Party Advisory, VDB Entry
www.us-cert.gov/ncas/alerts/TA15-195A · Third Party Advisory, US Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-077 · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2387 · US Government Resource