CVE-2009-2514

win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka "Win32k EOT Parsing Vulnerability."

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

47.49% chance of exploitation in the next 30 days, 99th percentile

Published

2009-11-11

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/browser/ms09_065_eo…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10068

References

• CVE Record
• NVD entry

Related

• CVE-2009-2511
• CVE-2009-2521
• CVE-2009-2485
• CVE-2009-2526
• CVE-2009-2484
• CVE-2009-2532