Login Request a demo
High severity · published Sep 26, 2012
CVE-2012-2897
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows…
7.8
CVSS
21.7%
EPSS
No
On KEV
Description
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)21.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
through 22.0.1229.78; 22.0.1229.0; 22.0.1229.1; 22.0.1229.2; 22.0.1229.3; 22.0.1229.4; +34 more · source: NVD
W7
Windows 7 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8 · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2003 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2008 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2012 · Microsoft
All versions, or not specified · source: NVD
WV
Windows Vista · Microsoft
All versions, or not specified · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
Affected product
CH
Chrome
Google
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2897
googlechromereleases.blogspot.com
http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
secunia.com
http://secunia.com/advisories/51239
www.securitytracker.com
http://www.securitytracker.com/id?1027750
www.us-cert.gov
http://www.us-cert.gov/cas/techalerts/TA12-318A.html
code.google.com
https://code.google.com/p/chromium/issues/detail?id=146254
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability