One font vulnerability to rule them all #1: Introducing the BLEND vulnerability

Summary: Google Project Zero researcher Mateusz Jurczyk disclosed a set of font-engine vulnerabilities found in a shared PostScript Charstring interpreter, including CVE-2015-0093 (Adobe's CVE-2015-3052), a flaw in the BLEND Charstring instruction present in Adobe Reader's CoolType library and the Windows kernel-mode ATMFD.DLL driver. Microsoft patched the issues in MS15-021 and MS15-044, and Adobe in APSB15-10, and Jurczyk built a proof-of-concept PDF that achieved code execution in Adobe Reader 11.0.10 and then a sandbox escape on Windows 8.1 Update 1 (32-bit).
What's compelling: The BLEND flaw gave an attacker arbitrary PostScript operations anywhere on the exploited thread's stack, enough to build a ROP chain that defeated stack cookies, DEP, ASLR and SMEP, and because the same bug lived in both the PDF viewer and the Windows kernel, one malicious Type 1 font could both execute code and escape the sandbox.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-0074 CVE-2015-0087 CVE-2015-0088 CVE-2015-0089 CVE-2015-0090 CVE-2015-0091 CVE-2015-0092 CVE-2015-0093 CVE-2015-1670 CVE-2015-3049 CVE-2015-3050 CVE-2015-3051 CVE-2015-3052 CVE-2015-3095
Related: Microsoft Patch Tuesday for March 2015: 14 Bulletins Released; FREAK Patched Cyber Risks ·
Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026