CVE-2016-7256HIGH · 8.8Patch third

Microsoft Windows Open Type Font Remote Code Execution Vulnerability

CVE-2016-7256 is a security vulnerability in Microsoft Windows, added to CISA KEV on May 25, 2022. Patch order: third of four.

Published (added to CISA KEV) May 25, 2022 · Updated June 17, 2026 · Microsoft Windows

What is CVE-2016-7256?

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.

VulnCheck tracked exploitation 2024 days before CISA's KEV listing. VulnCheck's broader catalog of in-the-wild exploitation evidence picked this up before it landed on CISA's formal list. Per-CVE fact about this entry; not a population claim about lead time in general.

Who is affected by CVE-2016-7256?

Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.

What should I do about CVE-2016-7256?

Apply updates per vendor instructions.

If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Request a free review.

Insurance readiness

Your insurer will ask if this is patched.

Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.

Get the free carrier questionnaire →

Severity

CVSS base score: 8.8 — HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS, severity, and CWE data from the National Vulnerability Database (NVD). This product uses data from the NVD API but is not endorsed or certified by the NVD.

Microsoft fix

KB3200970 (Security Update)
KB3198585 (Security Update)
KB3198586 (Security Update)
KB3197868 (Monthly Rollup)
KB3197867 (Security Only)
KB3197874 (Monthly Rollup)
KB3197873 (Security Only)
KB3203859 (Security Update)
KB3197877 (Monthly Rollup)
KB3197876 (Security Only)

Microsoft Exploitability Index (assessed at update release): Exploitation Less Likely

This CVE is on CISA's Known Exploited Vulnerabilities catalog. Microsoft's index reflects their release-time forecast, not current observed activity, and is not automatically revised upward when exploitation appears later.

Sourced from Microsoft Security Update Guide (CVRF document 2016-Nov).

Vendor workaround

Vendor-published workaround

Rename ATMFD.DLL For 32-bit systems:

Enter the following commands at an administrative command prompt: cd "%windir%\system32" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
Restart the system.

For 64-bit systems:

Enter the following commands at an administrative command prompt: cd "%windir%\system32" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll cd "%windir%\syswow64" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
Restart the system.

Optional procedure for Windows 8 and later operating systems (disable ATMFD): Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Method 1 (manually edit the system registry):

Run regedit.exe as Administrator.
In Registry Editor, navigate to the following sub key (or create it) and set its DWORD value to 1: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1
Close Registry Editor and restart the system.

Method 2 (use a managed deployment script):

Create a text file named ATMFD-disable.reg that contains the following text:

	Windows Registry Editor Version 5.00
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
	"DisableATMFD"=dword:00000001

Run regedit.exe.
In Registry Editor, click the File menu and then click Import.
Navigate to and select the ATMFD-disable.reg file that you created in the first step. (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
Click Open and then click OK to close Registry Editor.

Impact of workaround. Applications that rely on embedded font technology will not display properly. Disabling ATMFD.DLL could cause certain applications to stop working properly if they use OpenType fonts. Microsoft Windows does not release any OpenType fonts natively. However, third-party applications could install them and they could be affected by this change.

How to undo the workaround. For 32-bit systems:

Enter the following commands at an administrative command prompt:

	cd "%windir%\system32"
	rename x-atmfd.dll atmfd.dll
	icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
	icacls.exe . /restore atmfd.dll.acl

Restart the system.

For 64-bit systems:

Enter the following commands at an administrative command prompt:

	cd "%windir%\system32"
	rename x-atmfd.dll atmfd.dll
	icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
	icacls.exe . /restore atmfd.dll.acl
	cd "%windir%\syswow64"
	rename x-atmfd.dll atmfd.dll
	icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"
	icacls.exe . /restore atmfd.dll.acl

Restart the system.

Optional procedure for Windows 8 and later operating systems (enable ATMFD): Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Method 1 (manually edit the system registry):

Run regedit.exe as Administrator.
In Registry Editor, navigate to the following sub key and set its DWORD value to 0: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 0
Close Registry Editor and restart the system.

Method 2 (use a managed deployment script):

Create a text file named ATMFD-enable.reg that contains the following text:

	Windows Registry Editor Version 5.00
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
	"DisableATMFD"=dword:00000000

Run regedit.exe.
In Registry Editor, click the File menu and then click Import.
Navigate to and select the ATMFD-enable.reg file that you created in the first step. (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
Click Open and then click OK to close Registry Editor.

A workaround reduces exposure while you patch — it is not a substitute for the update. Install the fix above as soon as you can.

Shown as published by Microsoft (Security Update Guide, CVRF document 2016-Nov); formatting sanitized, content unaltered.

CISA due date

CISA's listed due date: June 15, 2022.

Federal civilian agencies work under CISA's Binding Operational Directive 26-04, which replaced BOD 22-01 on June 10, 2026. It sets the deadline for each affected system by:

How exposed that system is to the internet
Whether the attack can be automated
How much control it gives an attacker

Its table gives catalogued vulnerabilities 3 or 14 days.

None of this binds a private business, but treat the date as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).

EPSS

EPSS score: 64.6% — higher than 99% of all scored CVEs.

EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.

Score dated 2026-10-16, from the FIRST.org Exploit Prediction Scoring System.

Other exploited Microsoft Windows entries

More CISA KEV entries for Microsoft Windows. Same product line, same actively-exploited status.

Browse more

Source

This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.