---
title: "Old Windows Bugs in KEV: Duqu Font, IE ActiveX, CLFS"
url: https://erroneo.us/security/briefs/windows-cve-2011-3402-2013-3918-2021-43226-old-kev/
description: "CISA added Windows flaws from 2011, 2013 and 2021 to KEV in October 2025. All were fixed years ago; find hosts that are unpatched or end-of-life."
type: security-brief
section: "Security Digest"
date_published: 2011-11-03
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2011-3402", "CVE-2013-3918", "CVE-2021-43226"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Old Windows Bugs in KEV: Duqu Font, IE ActiveX, CLFS

**Verdict: Check exposure.** All three bugs were fixed between 2011 and 2021 and are closed on any supported Windows host that takes monthly updates; the real job is finding machines that missed years of patches or still run end-of-life Windows.

- **Who must act:** Owners of Windows hosts with no cumulative update since December 2021, and of any XP, Vista, 7, 8 or Server 2003/2008 machines still running in labs, factories or legacy applications.
- **Who can relax:** Teams whose Windows fleet runs supported releases on current monthly updates; every fix for these three CVEs is at least four years old.
- **Affected:** CVE-2011-3402: Windows XP, Server 2003, Vista, Server 2008 and 2008 R2, and Windows 7 without MS11-087; CVE-2013-3918: Windows XP through 8.1 and RT 8.1, and Server 2003 through 2012 R2, without MS13-090; CVE-2021-43226: Windows 7 SP1 through Windows 11 21H2, and Server 2008 SP2 through Server 2022, before the December 14, 2021 updates
- **Fixed:** MS11-087 / KB2639417 (Dec 13, 2011); MS13-090 / KB2900986 ActiveX kill-bit update (Nov 12, 2013); December 2021 updates, e.g. Windows 10 21H2 build 19044.1415 (KB5008212), Windows 11 21H2 build 22000.376 (KB5008215), Server 2016 build 14393.4825 (KB5008207), Server 2019 build 17763.2366 (KB5008218), Server 2022 build 20348.405 (KB5008223); Any later cumulative update on a supported release
- **CVEs:** CVE-2011-3402, CVE-2013-3918, CVE-2021-43226
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Export Windows versions and builds from your endpoint or patch tool and flag every end-of-life release (XP, Vista, 7, 8, 8.1, Server 2003, 2008).
2. Upgrade or replace end-of-life machines; if one must stay, cut its internet access, block browsing and document handling on it, and limit who can log on.
3. Bring every supported host to the latest cumulative update, not just the December 2021 build.
4. Because CLFS is a recurring ransomware target, confirm the later CLFS fixes in KEV, such as CVE-2025-29824, are installed too.
5. On legacy hosts that still run Internet Explorer, confirm the 2011 and 2013 updates with Get-HotFix -Id KB2639417,KB2900986.

### How to check if you are affected

- Compare each host's build and UBR (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion) with the fixed builds; anything older was exposed.
- On hosts that went years without updates, review EDR history for low-privilege processes that launched SYSTEM-level children, and for unknown services, drivers or scheduled tasks.
- Look for ransomware precursors on those hosts: new local administrators, disabled security tools, and mass file renames.

## What happened

On October 6, 2025, CISA [added seven vulnerabilities](https://www.cisa.gov/news-events/alerts/2025/10/06/cisa-adds-seven-known-exploited-vulnerabilities-catalog) to its Known Exploited Vulnerabilities catalog "based on evidence of active exploitation." Three were Windows bugs that Microsoft fixed long ago. Federal agencies had until October 27, 2025 to remediate them.

- **CVE-2011-3402** is a TrueType font parsing flaw in win32k.sys that runs attacker code in kernel mode. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2011-3402) says it was "exploited in the wild in November 2011 by Duqu" through crafted fonts in Word documents or web pages. Microsoft published [Security Advisory 2639658](https://learn.microsoft.com/en-us/security-updates/securityadvisories/2011/2639658) on November 3, 2011, then shipped the fix in [MS11-087](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087) on December 13, crediting Symantec and CrySyS.
- **CVE-2013-3918** is an out-of-bounds write in the InformationCardSigninHelper ActiveX control (icardie.dll), reached through Internet Explorer. In [MS13-090](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090) on November 12, 2013, Microsoft said it was "aware of limited, targeted attacks." The fix sets kill bits so IE never loads the control.
- **CVE-2021-43226** is an elevation of privilege in the Common Log File System (CLFS) driver, fixed on December 14, 2021. Microsoft's [update guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226) still lists it as not exploited and "Exploitation More Likely." CISA's [KEV entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226) marks it as known to be used in ransomware campaigns.

[NVD](https://nvd.nist.gov/vuln/detail/CVE-2011-3402) scores the two older bugs CVSS 3.1 8.8. Microsoft scores the CLFS bug 7.8 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-43226).

## Who is affected

The font bug affects Windows XP, Server 2003, Vista, Server 2008 and 2008 R2, and Windows 7. The ActiveX bug affects Windows XP through 8.1 and Server 2003 through 2012 R2, per [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-3918). All of those releases are now out of support. The CLFS bug reaches newer systems: Windows 7 SP1 through Windows 11 21H2, and Server 2008 SP2 through Server 2022. Fixed builds include 19044.1415 for Windows 10 21H2, 22000.376 for Windows 11 21H2, 17763.2366 for Server 2019 and 20348.405 for Server 2022. Every later cumulative update includes the fix.

## Do you really need to act?

For most teams, no. A host on a supported release with recent monthly updates is fixed for all three. CISA did not say what evidence prompted these listings, and no public report explains them as of Oct 23, 2026. [Security Affairs](https://securityaffairs.com/183049/security/u-s-cisa-adds-oracle-mozilla-microsoft-windows-linux-kernel-and-microsoft-ie-flaws-to-its-known-exploited-vulnerabilities-catalog.html) linked CVE-2013-3918 to older APT activity but gave no reason for the timing. The two older listings may simply record well-documented attacks from 2011 and 2013. No public report names the ransomware group that used the CLFS bug.

The real risk is a machine that fell out of patching, such as a factory PC or a server frozen for a legacy app. CLFS is a favorite of ransomware crews. [Kaspersky](https://securelist.com/windows-clfs-exploits-ransomware/111560/) counted attacker exploits for at least five CLFS driver bugs since June 2022. More CLFS bugs reached KEV later, including [CVE-2025-29824](https://www.cve.org/CVERecord?id=CVE-2025-29824) in April 2025 and CVE-2023-36424 in April 2026. Having the 2021 fix is not enough.

## What to do now

1. Export Windows versions and builds from your endpoint or patch tool, and flag every release past support.
2. Replace end-of-life machines. If one must stay, cut its internet access and limit who can log on.
3. On supported hosts, check the build with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild,UBR` and install the latest cumulative update.
4. On legacy hosts that still run Internet Explorer, run `Get-HotFix -Id KB2639417,KB2900986` to confirm the 2011 and 2013 updates.

## How to tell if you were hit

These bugs leave no dedicated log entry. On hosts that went years without updates, review EDR history for low-privilege processes that launched SYSTEM-level children. Look for unknown services, drivers or scheduled tasks, new local administrators and disabled security tools. If a legacy host shows any of these, rebuild it.

## Timeline

- Nov 3, 2011 — Microsoft publishes Security Advisory 2639658 for the Duqu font bug.
- Dec 13, 2011 — MS11-087 fixes CVE-2011-3402.
- Nov 12, 2013 — MS13-090 fixes CVE-2013-3918 after targeted attacks.
- Dec 14, 2021 — Microsoft fixes CVE-2021-43226.
- Oct 6, 2025 — CISA adds all three CVEs to KEV.
- Oct 27, 2025 — Federal remediation deadline.

## Sources

1. [Microsoft — Security Bulletin MS11-087: Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2639417)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087)
2. [Microsoft — Security Advisory 2639658: Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege](https://learn.microsoft.com/en-us/security-updates/securityadvisories/2011/2639658)
3. [Microsoft — Security Bulletin MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090)
4. [Microsoft — CVE-2021-43226 Windows Common Log File System Driver Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226)
5. [CVE record — CVE-2011-3402](https://www.cve.org/CVERecord?id=CVE-2011-3402)
6. [CVE record — CVE-2013-3918](https://www.cve.org/CVERecord?id=CVE-2013-3918)
7. [CVE record — CVE-2021-43226](https://www.cve.org/CVERecord?id=CVE-2021-43226)
8. [NVD — CVE-2011-3402](https://nvd.nist.gov/vuln/detail/CVE-2011-3402)
9. [NVD — CVE-2013-3918](https://nvd.nist.gov/vuln/detail/CVE-2013-3918)
10. [CISA — Known Exploited Vulnerabilities: CVE-2011-3402](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-3402)
11. [CISA — Known Exploited Vulnerabilities: CVE-2013-3918](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3918)
12. [CISA — Known Exploited Vulnerabilities: CVE-2021-43226](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226)
13. [CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (Oct 6, 2025)](https://www.cisa.gov/news-events/alerts/2025/10/06/cisa-adds-seven-known-exploited-vulnerabilities-catalog)
14. [CVE record — CVE-2025-29824](https://www.cve.org/CVERecord?id=CVE-2025-29824)
15. [Kaspersky Securelist — Windows CLFS and five exploits used by ransomware operators](https://securelist.com/windows-clfs-exploits-ransomware/111560/)
16. [Security Affairs — U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/183049/security/u-s-cisa-adds-oracle-mozilla-microsoft-windows-linux-kernel-and-microsoft-ie-flaws-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/windows-cve-2011-3402-2013-3918-2021-43226-old-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt