CVE-2015-2387

What Is ATMFD.DLL?

The Adobe Type Manager Font Driver (ATMFD.DLL) is a Windows kernel-mode font rendering component responsible for processing Adobe Type 1 PostScript and OpenType fonts. The driver runs in kernel mode as part of the Windows graphics subsystem, parsing complex font file structures and generating rendered glyph bitmaps. Because ATMFD.DLL operates in kernel context, an out-of-bounds write in font parsing directly enables kernel privilege escalation.

ATMFD.DLL has a history of security vulnerabilities due to the complexity of PostScript font parsing — the driver processes attacker-controlled binary data (font files) in kernel mode, making any parsing flaw potentially critical.

Overview

CVE-2015-2387 is an out-of-bounds write privilege escalation in the Windows ATM Font Driver (ATMFD.DLL) that allows local attackers to gain elevated privileges via a crafted application. The vulnerability was patched in MS15-077 (July 14, 2015) — the same Patch Tuesday that followed the Hacking Team data breach (July 5, 2015), which exposed multiple Windows zero-days including the related ATMFD/OpenType font vulnerabilities (CVE-2015-2426 was an out-of-band emergency patch from the Hacking Team leak).

Affected Versions

Fixed in MS15-077 (July 2015).

Technical Details

Root Cause: Out-of-Bounds Write in ATMFD Font Parsing

CVE-2015-2387 involves an out-of-bounds write (CWE-787) in ATMFD.DLL's processing of font data. The driver allocates a kernel buffer for font metrics or glyph data, but when processing a specially crafted font — with malformed table entries or incorrect size values — writes beyond the buffer's allocated bounds into adjacent kernel memory.

This kernel heap overflow can corrupt:

• Adjacent kernel objects — including objects with function pointers or privilege tokens
• Kernel security structures — such as the access token in the EPROCESS structure that determines process privileges

A successful exploit escalates the attacking process from a standard user to SYSTEM, bypassing all user-space privilege controls.

Privilege Escalation Path

1. Attacker executes a crafted application that loads a malicious font
2. ATMFD.DLL processes the font in kernel mode, triggering the out-of-bounds write
3. Adjacent kernel memory is corrupted — specifically targeting a security-critical structure
4. Application obtains SYSTEM token / kernel code execution

Attack Characteristics

Discovery

Reported to Microsoft and patched in MS15-077 as part of the July 2015 Patch Tuesday. The timing — nine days after the Hacking Team data breach — occurred during intense scrutiny of Windows font rendering components, as multiple font-related zero-days appeared in the Hacking Team data.

Exploitation Context

• Hacking Team context: The July 2015 Hacking Team breach exposed multiple Windows vulnerabilities targeting font rendering; while CVE-2015-2387 was patched on Patch Tuesday, its disclosure coincided with the emergency out-of-band patch for CVE-2015-2426 (an OpenType font RCE from the Hacking Team data), reflecting the intense focus on Windows font security in this period
• LPE exploit chain component: ATMFD.DLL privilege escalations are used as second-stage exploits in full attack chains — combined with a browser or document RCE for complete system compromise
• Targeted attacks: Kernel font driver LPE vulnerabilities require precise exploitation and are primarily used in targeted attacks by APT groups rather than mass exploitation
• CISA KEV (2022): Added March 2022

Remediation

1. Apply MS15-077 (July 2015). Any Windows system current with Windows Update after July 2015 includes this fix.

2. Disable ATMFD.DLL — for systems that cannot be patched immediately, Microsoft provided instructions to disable the ATM font driver via registry change:

   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD = 1
   

   Note: This disables rendering of OpenType/Type1 fonts.

3. Maintain current Windows patch levels — Microsoft has continued patching ATMFD.DLL (and eventually removed it entirely in Windows 10 2004 and later). Updated systems are protected.

4. Upgrade Windows — Windows 10 version 2004 (May 2020 Update) and later removed ATMFD.DLL from the OS entirely, eliminating this attack surface.