CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Windows Remote Code Execution Vulnerability

Vendor

Microsoft

Product

Windows

Added to the catalog

2025-10-06

Due date for US federal agencies

2025-10-27

Catalog version

2026.10.30

Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087
• https://nvd.nist.gov/vuln/detail/CVE-2011-3402

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2011-11-04T21:55:04.693

Last modified

2026-06-16T23:33:14.020

Weaknesses

NVD-CWE-noinfo

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

References

• http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files (Broken Link)
• http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx (Vendor Advisory)
• http://isc.sans.edu/diary/Duqu+Mitigation/11950 (Third Party Advisory)
• http://secunia.com/advisories/49121 (Vendor Advisory)
• http://secunia.com/advisories/49122 (Vendor Advisory)
• http://technet.microsoft.com/security/advisory/2639658 (Vendor Advisory)
• http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two (Not Applicable)
• http://www.securitytracker.com/id?1027039 (Broken Link)
• http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit (Not Applicable)
• http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf (Not Applicable)
• http://www.us-cert.gov/cas/techalerts/TA11-347A.html (US Government Resource)
• http://www.us-cert.gov/cas/techalerts/TA12-129A.html (US Government Resource)
• http://www.us-cert.gov/cas/techalerts/TA12-164A.html (US Government Resource)
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf (US Government Resource)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 (Vendor Advisory)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034 (Vendor Advisory)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 (Vendor Advisory)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998 (Broken Link)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290 (Broken Link)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645 (Broken Link)
• http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files (Broken Link)
• http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx (Vendor Advisory)
• http://isc.sans.edu/diary/Duqu+Mitigation/11950 (Third Party Advisory)
• http://secunia.com/advisories/49121 (Vendor Advisory)
• http://secunia.com/advisories/49122 (Vendor Advisory)
• http://technet.microsoft.com/security/advisory/2639658 (Vendor Advisory)
• http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two (Not Applicable)
• http://www.securitytracker.com/id?1027039 (Broken Link)
• http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit (Not Applicable)
• http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf (Not Applicable)
• http://www.us-cert.gov/cas/techalerts/TA11-347A.html (US Government Resource)
• http://www.us-cert.gov/cas/techalerts/TA12-129A.html (US Government Resource)
• http://www.us-cert.gov/cas/techalerts/TA12-164A.html (US Government Resource)
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf (US Government Resource)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 (Vendor Advisory)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034 (Vendor Advisory)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 (Vendor Advisory)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998 (Broken Link)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290 (Broken Link)
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645 (Broken Link)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3402 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:28.906Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2011-3402

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2011-11-04T21:00:00.000Z

Updated

2025-10-22T00:05:48.983Z

Problem types

n/a

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

References

• 49121
• oval:org.mitre.oval:def:15645
• TA12-164A
• http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files
• 1027039
• 49122
• MS11-087
• http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
• TA11-347A
• oval:org.mitre.oval:def:13998
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf
• http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two
• http://technet.microsoft.com/security/advisory/2639658
• MS12-034
• MS12-039
• oval:org.mitre.oval:def:15290
• http://isc.sans.edu/diary/Duqu+Mitigation/11950
• http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit
• TA12-129A
• http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx

Read on 2026-11-03T00:23:54.204Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2011/3xxx/CVE-2011-3402.json