Microsoft Windows Open Type Font Remote Code Execution Vulnerability
CVE-2016-7256 is a security vulnerability in Microsoft Windows, added to CISA KEV on May 25, 2022. Patch priority: Plan to patch.
What it is
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
VulnCheck tracked exploitation 2024 days before CISA's KEV listing. VulnCheck's broader catalog of in-the-wild exploitation evidence picked this up before it landed on CISA's formal list. Per-CVE fact about this entry; not a population claim about lead time in general.
Who's affected
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
What to do
Apply updates per vendor instructions.
If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Book a free 20-minute triage call.
Insurance readiness
Your insurer will ask if this is patched.
Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.
Get the free carrier questionnaire →Severity
CVSS base score: 8.8 — HIGH
Microsoft fix
- KB3200970 (Security Update)
- KB3198585 (Security Update)
- KB3198586 (Security Update)
- KB3197868 (Monthly Rollup)
- KB3197867 (Security Only)
- KB3197874 (Monthly Rollup)
- KB3197873 (Security Only)
- KB3203859 (Security Update)
- KB3197877 (Monthly Rollup)
- KB3197876 (Security Only)
Microsoft Exploitability Index (assessed at update release): Exploitation Less Likely
This CVE is on CISA's Known Exploited Vulnerabilities catalog. Microsoft's index reflects their release-time forecast, not current observed activity, and is not automatically revised upward when exploitation appears later.
Vendor workaround
Vendor-published workaround
Rename ATMFD.DLL For 32-bit systems:
- Enter the following commands at an administrative command prompt: cd "%windir%\system32" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
- Restart the system.
For 64-bit systems:
- Enter the following commands at an administrative command prompt: cd "%windir%\system32" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll cd "%windir%\syswow64" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
- Restart the system.
Optional procedure for Windows 8 and later operating systems (disable ATMFD): Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
Method 1 (manually edit the system registry):
- Run regedit.exe as Administrator.
- In Registry Editor, navigate to the following sub key (or create it) and set its DWORD value to 1:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1 - Close Registry Editor and restart the system.
Method 2 (use a managed deployment script):
- Create a text file named ATMFD-disable.reg that contains the following text:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DisableATMFD"=dword:00000001
- Run regedit.exe.
- In Registry Editor, click the File menu and then click Import.
- Navigate to and select the ATMFD-disable.reg file that you created in the first step. (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
- Click Open and then click OK to close Registry Editor.
Impact of workaround. Applications that rely on embedded font technology will not display properly. Disabling ATMFD.DLL could cause certain applications to stop working properly if they use OpenType fonts. Microsoft Windows does not release any OpenType fonts natively. However, third-party applications could install them and they could be affected by this change.
How to undo the workaround. For 32-bit systems:
- Enter the following commands at an administrative command prompt:
cd "%windir%\system32"
rename x-atmfd.dll atmfd.dll
icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
icacls.exe . /restore atmfd.dll.acl
- Restart the system.
For 64-bit systems:
- Enter the following commands at an administrative command prompt:
cd "%windir%\system32"
rename x-atmfd.dll atmfd.dll
icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
icacls.exe . /restore atmfd.dll.acl
cd "%windir%\syswow64"
rename x-atmfd.dll atmfd.dll
icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
icacls.exe . /restore atmfd.dll.acl
- Restart the system.
Optional procedure for Windows 8 and later operating systems (enable ATMFD): Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.
Method 1 (manually edit the system registry):
- Run regedit.exe as Administrator.
- In Registry Editor, navigate to the following sub key and set its DWORD value to 0:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 0 - Close Registry Editor and restart the system.
Method 2 (use a managed deployment script):
- Create a text file named ATMFD-enable.reg that contains the following text:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DisableATMFD"=dword:00000000
- Run regedit.exe.
- In Registry Editor, click the File menu and then click Import.
- Navigate to and select the ATMFD-enable.reg file that you created in the first step. (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
- Click Open and then click OK to close Registry Editor.
A workaround reduces exposure while you patch — it is not a substitute for the update. Install the fix above as soon as you can.
CISA due date
Federal deadline: June 15, 2022. Federal agencies must complete the required action by this date. For private SMBs the deadline is advisory — but treat it as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).
EPSS
EPSS score: 64.8% — higher than 99% of all scored CVEs.
EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.
Other exploited Microsoft Windows entries
More CISA KEV entries for Microsoft Windows. Same product line, same actively-exploited status.
Source
This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.