Remote Code Execution in Microsoft Windows Kernel (CVE‑2011‑3402) via Crafted Font Data
What It Is — A remote‑code‑execution vulnerability in the Windows kernel’s TrueType font parsing engine (win32k.sys). An attacker can execute arbitrary code by delivering a malicious font embedded in a Word document or a web page.
Exploitability — Publicly disclosed with proof‑of‑concept; no confirmed active campaign, but the flaw is network‑reachable and requires only user interaction (opening a document or visiting a page). CVSS v3.1 base score 7.5 (High).
Affected Products — Microsoft Windows operating systems that include the vulnerable win32k.sys driver (all supported versions at the time of disclosure).
Why It Matters for Trust & Control Assurance
- Underscores the necessity of a vulnerability‑management control objective—continuous discovery, risk rating, and timely remediation.
- Shows that patch‑management evidence is a core audit artifact across frameworks (NIST CSF, ISO 27001, etc.).
- Illustrates why continuous control mapping and evidence collection are essential for a defensible security posture and audit readiness.
Recommended Actions
- Inventory Windows endpoints and identify those running the vulnerable kernel version.
- Deploy Microsoft’s security update that resolves CVE‑2011‑3402.
- Verify patch installation through endpoint management tools and capture remediation logs.
- Map the remediation activity to your vulnerability‑management control objective and store evidence in a Trust Center for audit readiness.
Source: CISA KEV – CVE‑2011‑3402