A year of Windows kernel font fuzzing #2: the techniques
Summary: Google Project Zero's Mateusz Jurczyk spent a year fuzzing the Windows kernel font engine, using a 19,507-file corpus (14,848 TrueType and 4,659 OpenType fonts, about 2.4G) drawn from earlier FreeType2 work and mutating each SFNT table individually rather than the file as a whole. He tuned mutation ratios so each table would still load roughly 93% of the time, and 15 of the 16 vulnerabilities found during the effort came from that configuration.
Why it matters: Fifteen of sixteen kernel font bugs fell out of one decision - mutating each of the roughly 20 important SFNT tables on its own terms instead of treating the file as an opaque blob - which is the difference between a fuzzer that reaches the parser and one that bounces off the loader.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026