Skip to content

Remove link to blog post from exploit protection reference #371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: public
Choose a base branch
from
Open

Remove link to blog post from exploit protection reference #371

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion defender-endpoint/exploit-protection-reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ Block untrusted fonts mitigates the risk of a flaw in font parsing leading to th

This mitigation is implemented within GDI, which validates the location of the file. If the file isn't in the system fonts directory, the font won't load for parsing and the call will fail.

This mitigation is in addition to the built-in mitigation provided in Windows 10 1607 and later, and Windows 11, which moves font parsing out of the kernel and into a user-mode app container. Any exploit based on font parsing, as a result, happens in a sandboxed and isolated context, which reduces the risk significantly. For details on this mitigation, see the blog [Hardening Windows 10 with zero-day exploit mitigations](https://www.microsoft.com/security/blog/2017/01/13/hardening-windows-10-with-zero-day-exploit-mitigations/).
This mitigation is in addition to the built-in mitigation provided in Windows 10 1607 and later, and Windows 11, which moves font parsing out of the kernel and into a user-mode app container. Any exploit based on font parsing, as a result, happens in a sandboxed and isolated context, which reduces the risk significantly.

### Compatibility considerations

Expand Down