CVE-2016-7256

atmfd.dll, the Adobe Type Manager (ATM) font driver in the Windows font library, improperly processes crafted OpenType fonts, allowing remote code execution. An attacker triggers the flaw by luring a user to a crafted website (or otherwise getting the user's system to parse attacker-supplied OpenType font content); no authentication is required, but user interaction is needed. Successful exploitation lets the attacker execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability. The affected range spans nearly every Windows release of the era, from Windows Vista SP2 through Windows 10 1607 and Windows Server 2016, so the potentially vulnerable population is enormous. The flaw is confirmed exploited in the wild (CISA KEV, added 2022-05-25, ransomware use unknown), carries a very high EPSS (~65% chance of exploitation in 30 days, 99th percentile), and Microsoft patched it in the November 2016 security updates.

What to do: Apply Microsoft's November 2016 security update (MS16-144) or a later cumulative/monthly rollup that includes it, per the CISA KEV required action. For legacy systems still running Windows 7/8.1, Server 2008/2008 R2/2012, verify the patch (atmfd.dll updated) rather than assuming, since these OSes are past mainstream support. As interim mitigation, block untrusted OpenType fonts and avoid visiting untrusted websites or previewing untrusted files on unpatched systems.