One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation

Summary: Google Project Zero's Mateusz Jurczyk detailed how the BLEND PostScript operator vulnerability in ATMFD.DLL can be reached from Adobe Reader's renderer process and used to escape the sandbox on 32-bit Windows 8.1. Because AddFontResource is blocked in the sandbox and AddFontMemResourceEx cannot load multi-file Type 1 fonts, he reverse engineered the undocumented NtGdiAddRemoteFontToDC system call to load a crafted font from memory, then used a ROP chain to call ExAllocatePool(NonPagedPool) and run ring-0 shellcode that copies the System process token onto AcroRd32.exe.
Bottom line: The exploit needed only an undocumented system call and a kernel font parser to go from a PDF to SYSTEM, and ATMFD.DLL's blanket try/except blocks silently swallow the memory corruption that fuzzers would otherwise report - meaning bugs in this attack surface can stay hidden from the people hunting them.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026