Old Windows Bugs in KEV: Duqu Font, IE ActiveX, CLFS

What to do

1. Export Windows versions and builds from your endpoint or patch tool and flag every end-of-life release (XP, Vista, 7, 8, 8.1, Server 2003, 2008).
2. Upgrade or replace end-of-life machines; if one must stay, cut its internet access, block browsing and document handling on it, and limit who can log on.
3. Bring every supported host to the latest cumulative update, not just the December 2021 build.
4. Because CLFS is a recurring ransomware target, confirm the later CLFS fixes in KEV, such as CVE-2025-29824, are installed too.
5. On legacy hosts that still run Internet Explorer, confirm the 2011 and 2013 updates with Get-HotFix -Id KB2639417,KB2900986.

How to check if you are affected or compromised

• Compare each host's build and UBR (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion) with the fixed builds; anything older was exposed.
• On hosts that went years without updates, review EDR history for low-privilege processes that launched SYSTEM-level children, and for unknown services, drivers or scheduled tasks.
• Look for ransomware precursors on those hosts: new local administrators, disabled security tools, and mass file renames.

What happened#

On October 6, 2025, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog "based on evidence of active exploitation." Three were Windows bugs that Microsoft fixed long ago. Federal agencies had until October 27, 2025 to remediate them.

• CVE-2011-3402 is a TrueType font parsing flaw in win32k.sys that runs attacker code in kernel mode. The CVE record says it was "exploited in the wild in November 2011 by Duqu" through crafted fonts in Word documents or web pages. Microsoft published Security Advisory 2639658 on November 3, 2011, then shipped the fix in MS11-087 on December 13, crediting Symantec and CrySyS.
• CVE-2013-3918 is an out-of-bounds write in the InformationCardSigninHelper ActiveX control (icardie.dll), reached through Internet Explorer. In MS13-090 on November 12, 2013, Microsoft said it was "aware of limited, targeted attacks." The fix sets kill bits so IE never loads the control.
• CVE-2021-43226 is an elevation of privilege in the Common Log File System (CLFS) driver, fixed on December 14, 2021. Microsoft's update guide still lists it as not exploited and "Exploitation More Likely." CISA's KEV entry marks it as known to be used in ransomware campaigns.

NVD scores the two older bugs CVSS 3.1 8.8. Microsoft scores the CLFS bug 7.8 on the CVE record.

Who is affected#

The font bug affects Windows XP, Server 2003, Vista, Server 2008 and 2008 R2, and Windows 7. The ActiveX bug affects Windows XP through 8.1 and Server 2003 through 2012 R2, per NVD. All of those releases are now out of support. The CLFS bug reaches newer systems: Windows 7 SP1 through Windows 11 21H2, and Server 2008 SP2 through Server 2022. Fixed builds include 19044.1415 for Windows 10 21H2, 22000.376 for Windows 11 21H2, 17763.2366 for Server 2019 and 20348.405 for Server 2022. Every later cumulative update includes the fix.

Do you really need to act?#

For most teams, no. A host on a supported release with recent monthly updates is fixed for all three. CISA did not say what evidence prompted these listings, and no public report explains them as of Oct 23, 2026. Security Affairs linked CVE-2013-3918 to older APT activity but gave no reason for the timing. The two older listings may simply record well-documented attacks from 2011 and 2013. No public report names the ransomware group that used the CLFS bug.

The real risk is a machine that fell out of patching, such as a factory PC or a server frozen for a legacy app. CLFS is a favorite of ransomware crews. Kaspersky counted attacker exploits for at least five CLFS driver bugs since June 2022. More CLFS bugs reached KEV later, including CVE-2025-29824 in April 2025 and CVE-2023-36424 in April 2026. Having the 2021 fix is not enough.

What to do now#

1. Export Windows versions and builds from your endpoint or patch tool, and flag every release past support.
2. Replace end-of-life machines. If one must stay, cut its internet access and limit who can log on.
3. On supported hosts, check the build with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild,UBR and install the latest cumulative update.
4. On legacy hosts that still run Internet Explorer, run Get-HotFix -Id KB2639417,KB2900986 to confirm the 2011 and 2013 updates.

How to tell if you were hit#

These bugs leave no dedicated log entry. On hosts that went years without updates, review EDR history for low-privilege processes that launched SYSTEM-level children. Look for unknown services, drivers or scheduled tasks, new local administrators and disabled security tools. If a legacy host shows any of these, rebuild it.

Timeline#

• Nov 3, 2011 — Microsoft publishes Security Advisory 2639658 for the Duqu font bug.
• Dec 13, 2011 — MS11-087 fixes CVE-2011-3402.
• Nov 12, 2013 — MS13-090 fixes CVE-2013-3918 after targeted attacks.
• Dec 14, 2021 — Microsoft fixes CVE-2021-43226.
• Oct 6, 2025 — CISA adds all three CVEs to KEV.
• Oct 27, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2011-3402 · KEV 2025-10-06 · Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server…
• CVE-2013-3918 · KEV 2025-10-06 · The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows…
• CVE-2021-43226 · KEV 2025-10-06 · Windows Common Log File System Driver Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Bulletin MS11-087: Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2639417) learn.microsoft.com
2. Microsoft — Security Advisory 2639658: Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege learn.microsoft.com
3. Microsoft — Security Bulletin MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) learn.microsoft.com
4. Microsoft — CVE-2021-43226 Windows Common Log File System Driver Elevation of Privilege Vulnerability msrc.microsoft.com
5. CVE record — CVE-2011-3402 cve.org
6. CVE record — CVE-2013-3918 cve.org
7. CVE record — CVE-2021-43226 cve.org
8. NVD — CVE-2011-3402 nvd.nist.gov
9. NVD — CVE-2013-3918 nvd.nist.gov
10. CISA — Known Exploited Vulnerabilities: CVE-2011-3402 cisa.gov
11. CISA — Known Exploited Vulnerabilities: CVE-2013-3918 cisa.gov
12. CISA — Known Exploited Vulnerabilities: CVE-2021-43226 cisa.gov
13. CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (Oct 6, 2025) cisa.gov
14. CVE record — CVE-2025-29824 cve.org
15. Kaspersky Securelist — Windows CLFS and five exploits used by ransomware operators securelist.com

Coverage and analysis

1. Security Affairs — U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com