Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2011-3402

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

CVSS 8.8 · HighBuzz score 60.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 60.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 13.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Mozilla, Linux Kernel, Microsoft Windows, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Linux Kernel, Mozilla, Microsoft Windows, and Microsoft IE flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: This […]

    newssecurityaffairs.comOct 7, 2025, 6:59 AM
  • Chinese Hackers Cloned Equation Group Exploit Years Before Shadow Brokers LeakSecurityWeek

    A Chinese threat actor known as APT31 likely acquired and cloned one of the Equation Group’s exploits three years before the targeted vulnerability was publicly exposed as part of Shadow Brokers’ “Lost in Translation” leak, cybersecurity firm Check Point says in a new report.

    newswww.securityweek.comFeb 22, 2021, 3:06 PM
  • The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-DayCheck Point Research

    Research by: Eyal Itkin and Itay Cohen There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has already happened. What […]

    vendorresearch.checkpoint.comFeb 22, 2021, 11:00 AM
  • Cyber Threat Intelligence Shows Majority of Cybercrime is NOT SophisticatedSecurityWeek

    It’s a new year and while some things change, some things stay the same (or similar). There’s lots of FUD about the sophisticated cyber attacks that are multi-threaded and obfuscated. Certainly there are attacks that fall into this category, but if you look at all of the cybercrime activity from the past year, it’s clear that the majority of threats do not have the level of sophistication that is often talked about.

    newswww.securityweek.comJan 20, 2017, 4:16 PM
  • Multiple Patch Tuesday Vulnerabilities Under AttackSecurityWeek

    It is a busy day in the world of Microsoft security.

    newswww.securityweek.comOct 14, 2014, 5:43 PM
  • Blackhole Exploit Kit Use Falls Off After ArrestSecurityWeek

    Two weeks ago, it was reported that police in Russia arrested the reputed author of the Blackhole Exploit kit, a man who went by the hacker alias ‘Paunch.’ In the aftermath, the number of spam campaigns using Blackhole to distribute malware fell off, and in the past two weeks have still not recovered.

    newswww.securityweek.comOct 21, 2013, 10:21 PM
  • Microsoft Plugs 23 Security Holes in May Patch Tuesday UpdateSecurityWeek

    Security researchers are warning Microsoft customers to keep their eyes on the critical bulletins in this month’s Patch Tuesday update.

    newswww.securityweek.comMay 8, 2012, 7:51 PM
  • Threat incidents and security wins in 2011Help Net Security

    Having spent much of the year battling data breaches that led to huge information and financial loss, the security industry was likely relieved to see 2011 come to a close. In its annual threat roundup report, Trend Micro wraps 2011 as “The Year of Data Breaches,” after witnessing large, well-known companies succumb to targeted data breach attacks that not only stained reputations, but caused them significant collateral damage. This year’s report revisits past predictions, and … More →

    newswww.helpnetsecurity.comJan 17, 2012, 11:49 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence