A vector drawing contains no code, but it does contain names, and a name can point to a server. This is episode 4 of File Security 101, our series on file-based threats your anti-malware does not see.
The video explains it in about two minutes.
The article adds the details and the research behind it.
Windows metafiles, WMF and its successor EMF, are the vector drawing formats built into Windows. Diagrams, floor plans and clip art travel in them, on their own or embedded in Office documents and Outlook messages. A metafile holds lines, shapes and text labels; nothing in it runs.
Inside, a metafile is a sequence of records, each one a drawing command for the Windows graphics interface: create a pen, draw a polyline, create a font, select it, write a string. Normally the font itself is not stored in the file. The font record carries a typeface name in a field of at most 32 characters, and Windows matches that name against the fonts available on the computer (Microsoft, LOGFONT).
The same formats also contain records that name a file outright. An EMF can, for example, specify a color profile "in a file with a name", with the name stored in the record (Microsoft, MS-EMF).
The attacker writes a network path into the typeface name, such as \\files.example.net\f.ttf. The Windows graphics engine treats the field as a font name. The risk lies with software that treats it as a file to load: converters, preview tools or server-side renderers with their own font handling. When such a program opens the path, Windows connects to the attacker's server over SMB, port 445, and signs in automatically with the current user's credentials.
What the attacker receives is the user's NTLM challenge-response, often called the Net-NTLMv2 hash. It can be cracked offline to recover the password, or relayed to another server to sign in there as the user (Microsoft). If the program actually loads a font file from the share, a second risk follows: the attacker's font goes through a font parser, which has a long history of serious bugs.
The technique behind this attack is well documented: MITRE ATT&CK lists it as T1187, Forced Authentication, with examples such as documents that load a remote template and shortcut files whose icon points to a remote path.
The best-known recent case used a different field in a different format. In March 2023, Microsoft fixed CVE-2023-23397 in Outlook for Windows: a message whose reminder sound was set to a UNC path on the attacker's server leaked the recipient's Net-NTLMv2 hash when the reminder fired, without any user interaction. Microsoft attributed the attacks to Forest Blizzard, a Russian state-sponsored actor (Microsoft). The flaw is on CISA's Known Exploited Vulnerabilities list.
Fonts have also been an entry point in their own right. In 2011, the Duqu installer arrived in a Word document with an embedded TrueType font that exploited the Windows kernel's font parser (Route Fifty); Microsoft fixed it as CVE-2011-3402 in December 2011. In July 2015, Microsoft released an emergency update, MS15-078, for an OpenType font flaw in the Adobe Type Manager library found in the leaked files of the surveillance vendor Hacking Team, CVE-2015-2426 (Computerworld). Both are on CISA's Known Exploited Vulnerabilities list.
A malware scanner finds nothing, because the file holds no code: just a name that happens to be a path. The drawing still looks right, since a font that cannot be found is replaced by another one. The only trace is an outgoing connection to a file share, and nobody looks at that while reading a floor plan.
bowbridge Content Disarm and Reconstruct draws the metafile into its own bounded surface and outputs a plain picture. Font names are never opened as paths, text is drawn with a built-in font, and color profiles or other external references are dropped, so the rebuilt picture contains no reference to the attacker's share.
Join the bowbridge CDR beta program