CVE-2016-3303

Think of your computer’s ability to display fancy fonts like a “reader” that interprets font data inside documents and messages. This vulnerability is like a hole in that reader: a specially crafted font can trick the system into running attacker code. In practice, it’s the kind of problem that can turn a malicious file or message into a full device compromise.

This matters if you run or use Microsoft Windows (Vista SP2, Windows 7, Windows Server 2008 SP2/R2 SP1), Microsoft Office (2007 SP3/2010 SP2) and/or Word Viewer, and also Skype for Business/Lync/Live Meeting components. The risk is higher where your environment allows users to open untrusted documents or receive untrusted messages that get processed by these components—this is typically only a risk if the attacker can send you a crafted document/message that reaches the vulnerable component.

This is AMBER because there is known public exploit code and an attacker can use a crafted embedded font inside a document/message to try to run code. While it’s not confirmed as a CISA KEV item in the provided findings, the presence of a public exploit and rising attention means you should treat it as an active patch-now priority for any affected systems.