Technical intelligence and weaponization dossier for CVE-2011-3402. Documented exploitation across 1 active malware families totaling 61 analyzed telemetry samples.
| Vulnerability ID | CVE-2011-3402 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Win32k TrueType Font Parsing LPE / RCE (Duqu) (MS11-087) |
| CWE Classification | CWE-119: Memory Corruption in Kernel-mode Driver |
| Affected Software & Versions | Microsoft Windows XP, Vista, 7, Server 2003, Server 2008 |
| Technical Root Cause | Kernel-mode TrueType font engine in Win32k.sys failed to validate table records in malicious TTF fonts embedded within Microsoft Word documents, granting ring-0 execution. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2011-3402 in enterprise networks:
WinWord.exe loading embedded TrueType fonts with invalid table checksums or unusual glyph bytecode programs.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →