CVE-2011-3402

Successful exploitation permits arbitrary code execution in kernel mode and administrative compromise of the affected Windows system. An attacker can install programs, view, modify or delete data, and create accounts with full administrative rights. The vulnerability also supports local privilege escalation and has been used as an elevation stage in malware infection chains.

Deny access to T2EMBED.DLL to mitigate web-based and file-sharing attack scenarios. This workaround does not prevent local exploitation and can disrupt applications that depend on embedded fonts, including Microsoft Office PDF generation. The default Restricted Sites configuration in Outlook, Outlook Express and Windows Mail disables font downloads in HTML email, limiting that delivery route but not other exploitation paths.

Apply Microsoft update KB2639417, released on December 13, 2011 under security bulletin MS11-087. The update changes how the Windows kernel-mode driver handles TrueType font files. If the embedded-font workaround was previously applied, remove it after installing the update to restore affected application functionality.