Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure

Summary: Google Project Zero researcher Mateusz Jurczyk detailed a memory disclosure vulnerability in the PostScript font engines shared by the Windows kernel ATMFD.DLL (CVE-2015-0089), Adobe Reader (CVE-2015-3049), DirectWrite and Windows Presentation Foundation (CVE-2015-1670), and Oracle Java (CVE-2015-2619), all fixed between March and July 2015. The flaw let a malicious Charstring use the 'get' instruction to copy uninitialized heap or kernel pool memory into a glyph's rendered shape, and Internet Explorer was the only major browser left exposed because Chrome and Firefox block the instruction through the OpenType Sanitiser whitelist.
Why it matters: A single font file could leak 128 bytes of uninitialized memory per glyph, enough to defeat ASLR for a user-mode application and then the kernel, turning a rendering bug into a link in a full remote code execution and sandbox-escape chain.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-0089 CVE-2015-0093 CVE-2015-1670 CVE-2015-2619 CVE-2015-3049 CVE-2015-3052
Related: One font vulnerability to rule them all #1: Introducing the BLEND vulnerability Cyber Risks ·
Microsoft Patch Tuesday for March 2015: 14 Bulletins Released; FREAK Patched Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026