CVE-2015-2387: Microsoft ATM Font Driver Privilege Escalation Vulnerability
What It Is — A local privilege‑escalation flaw in ATMFD.DLL, the Adobe Type Manager font driver bundled with Microsoft Windows Server. An attacker who can run a crafted application on the host can obtain SYSTEM‑level rights.
Exploitability — The vulnerability is exploitable locally without requiring network access. Public proof‑of‑concept code exists, and the CVSS v3 score is 7.8 (High).
Affected Products — Microsoft Windows Server editions that include the ATM Font Driver (ATMFD.DLL).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for robust privileged‑access controls and continuous monitoring of high‑privilege binaries.
- Unpatched privilege‑escalation bugs erode audit evidence of “least‑privilege” compliance, a key control across NIST CSF 2.0, ISO 27001, and other frameworks.
- Enterprises must prove timely patch management and evidence of remediation to satisfy auditors and security‑focused buyers.
Recommended Actions
- Deploy Microsoft’s security update that removes or hardens the ATM Font Driver.
- Verify the installed version of
ATMFD.DLLacross all Windows Server assets via automated inventory. - Enforce least‑privilege policies: restrict execution of non‑administrative binaries and monitor for anomalous use of the driver.
- Capture patch‑status evidence in a centralized control‑monitoring platform for audit readiness.
Source: CISA KEV – CVE‑2015‑2387