CVE-2016-7182

CRITICAL

Microsoft Windows Vista - Remote Code Execution via Crafted True Type Font

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-7182. PoCs published by Google Security Research.

AI-analyzed exploit summary The writeup describes a use-after-free vulnerability in Windows kernel (win32k.sys) triggered by corrupted TTF font files, leading to crashes in win32k!sbit_Embolden and win32k!ttfdCloseFontContext functions. The issue affects Windows 7 and 8.1, with mutations in the 'OS/2' and 'VDMX' tables identified as the root cause.

Description

The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows attackers to execute arbitrary code via a crafted True Type font, aka "True Type Font Parsing Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WRITEUP VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/40599

The writeup describes a use-after-free vulnerability in Windows kernel (win32k.sys) triggered by corrupted TTF font files, leading to crashes in win32k!sbit_Embolden and win32k!ttfdCloseFontContext functions. The issue affects Windows 7 and 8.1, with mutations in the 'OS/2' and 'VDMX' tables identified as the root cause.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 7 and 8.1 (win32k.sys)
No auth needed
Prerequisites: Corrupted TTF font file with specific mutations in 'OS/2' and 'VDMX' tables · Special Pools enabled for win32k.sys (for immediate crash) · Custom program to display font glyphs at various sizes · Performance settings adjusted for best performance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036988
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93395

Scores

CVSS v3 9.8
EPSS 0.4148
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (18)
microsoft/live_meeting 2007
microsoft/lync 2010 (2 CPE variants)
microsoft/lync 2013 sp1
microsoft/office 2007 sp3
microsoft/office 2010 sp2
microsoft/skype_for_business 2016
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_10 1607
microsoft/windows_7
... and 8 more
Published Oct 14, 2016
Tracked Since Feb 18, 2026