Is CVE-2011-3402 (Microsoft Windows Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2011-3402 to its Known Exploited Vulnerabilities catalogue on 6 October 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

What the evidence means for this CVE

The key question is not whether the flaw is theoretically dangerous, but whether exploitation is already happening. CISA listing this CVE in KEV means defenders should treat it as an active threat condition, not a future-risk item. The practical implication is that exposure review, remediation priority and compromise checking all need to move ahead of normal vulnerability queues.

For this kind of remote code execution issue, the first operational task is to confirm where the vulnerable Windows components or the affected attack surface are present, then decide whether the system is internet-facing, user-facing or reachable through document handling workflows. That distinction changes how aggressively you triage and how quickly you assume an attacker could have reached it.

How to respond if patching is delayed

If you cannot remediate immediately, focus on shrinking the reachable attack path. That usually means removing or reducing exposure to the content paths that can deliver the crafted font data, tightening any web or email ingress points that can feed the trigger, and isolating the most exposed systems until the fix is in place. For exploit-driven issues, delay without compensating controls is the main failure mode.

When a fix must wait, the right question is whether the system can still be safely left online at the same trust level. If the answer is no, move to containment rather than hoping detection alone will catch abuse. Review logs for unusual document delivery, browser activity or post-exploitation behaviour, because active exploitation often leaves only a short forensic window.

What to check after suspected exposure

For a remotely exploitable Windows flaw, the most useful compromise check is not just whether the host crashed or behaved oddly. Look for unusual process creation, child processes spawned from user applications, suspicious script execution, unexpected persistence and outbound connections that do not match the workstation or server role. If the endpoint handled hostile content, treat that as a possible compromise path even when there is no obvious alert.

If the affected system had access to sensitive data, internal services or administrative functions, assume the blast radius may extend beyond the initial host. That is especially true when the vulnerable machine is a workstation used to open documents or browse web content, because the initial code execution can become a pivot into credentials, sessions or adjacent systems.

Risk and Threat Considerations

Active exploitation changes the risk profile from patch management to incident readiness. The main concern is not just remote code execution, but the speed with which attackers can turn a user-triggered flaw into foothold, persistence or lateral movement before defenders have time to react.

Failure mechanism: Crafted font data embedded in a document or web page can trigger code execution in the Windows kernel path, which means a normal-looking content interaction becomes an attack delivery channel.

Impact: Successful exploitation can lead to system takeover, follow-on malware, credential theft, or use of the host as a pivot point into the wider environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes rapid identification and remediation of exposed hosts central.
Recommendation — Prioritise and remediate internet-facing and user-exposed systems first.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires timely flaw remediation once active exploitation is confirmed.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and compromise checking depend on reliable vulnerability identification.
	SI-4 — System Monitoring	Suspected exploitation requires monitoring for post-exploitation behaviour and malicious activity.
Recommendation — Track, assess and remediate the vulnerable Windows flaw on an urgent cycle. Scan for susceptible hosts and verify exposure before normal patch scheduling. Correlate endpoint and network logs for signs of exploitation or follow-on activity.
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation calls for monitoring unusual network and host behaviour after delivery.
Recommendation — Monitor affected hosts for anomalous connections and suspicious execution chains.

Practitioner Guidance

What to verify: Confirm which assets can still receive or render the relevant content types, which of those assets are high-value, and whether compensating controls actually reduce exposure rather than just slowing the attack path.

What to prioritise: Prioritise externally reachable or user-content-exposed Windows systems first, because those are the systems most likely to be targeted once a CVE appears in KEV.

Practitioner takeaway: Once a Windows RCE reaches KEV, the decision is no longer whether to patch eventually, but whether you can prove the exposed hosts are contained, verified and not already abused.