Notes on Windows Uniscribe Fuzzing

Summary: Google Project Zero's Mateusz Jurczyk reports that fuzzing the user-mode Windows Uniscribe library (usp10.dll) in late 2016 produced 8 high-severity issues that could allow remote code execution, all but one reachable through a standard DrawText call and resulting in heap memory corruption. The work also yielded 27 unique invalid-read crashes representing 21 bugs, fixed by Microsoft in the MS17-011 bulletin as CVE-2017-0083, CVE-2017-0091, CVE-2017-0092 and CVE-2017-0111 through CVE-2017-0128, plus 7 NULL pointer dereferences that MSRC declined to fix as low-severity DoS.
Why it matters: Uniscribe dates back to Windows 2000 and parses attacker-controlled font tables in ring-3, reachable by ordinary text rendering in any GDI application - a surface that had not been widely recognized as a viable attack vector before this run.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-7274
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026