Fact-checked by Grok 2 weeks ago

Embedded OpenType

Embedded OpenType (EOT) is a compact, font developed by to enable the embedding of and fonts within web pages, facilitating the download and precise rendering of custom while enforcing end-user agreements through built-in restrictions such as binding and . Introduced in 1997 alongside , EOT emerged as 's solution to the limitations of system fonts for , allowing designers to specify high-quality fonts without relying on users' installed typefaces, though it was initially tied to browser support. In , submitted the format to the (W3C) for standardization, highlighting its use of MicroType Express , XOR-based for data, and an embedded structure that includes details like font names, PANOSE classifications, and coverage ranges across versions 1.0, 2.1, and 2.2. While EOT played a pivotal role in the early evolution of web typography by complementing the CSS @font-face rule, its nature and browser-specific implementation led to fragmentation in the ecosystem, prompting the development of open alternatives like WOFF in 2009 and WOFF2 in 2014. Today, EOT is considered a legacy format, primarily supported in older versions of and , with modern favoring more efficient, standards-compliant options for broader compatibility and performance.

Introduction

Definition and Purpose

Embedded OpenType (EOT) is a compact font derived from the specification, developed by specifically for embedding fonts in web pages to enable their download and rendering by browsers. It uses the .eot file extension and is based on or fonts, supporting both outlines and outlines via the Compact Font Format (CFF), though certain compression features apply differently to CFF data. This format was introduced in 1997 to facilitate web typography without requiring users to have the fonts installed locally. The primary purpose of EOT is to allow web designers and developers to embed custom fonts directly into , ensuring consistent visual appearance across different devices and operating systems while respecting font licensing restrictions that often prohibit unrestricted distribution of full font files. By fonts, EOT addresses the limitations of relying on system-installed fonts, which vary widely and can lead to inconsistent rendering of text on pages. It supports the inclusion of both and PostScript-based outlines, making it versatile for high-quality typographic control in . A key feature of EOT is its built-in mechanisms, such as the RootString, which encrypts and restricts font usage to specific URLs to verify licensing compliance before the font is unpacked and rendered by the . Additionally, EOT files are typically subsetted to include only the glyphs necessary for the intended text, significantly reducing for faster delivery and minimizing usage. These elements ensure that embedded fonts can be distributed securely while adhering to end-user agreements (EULAs).

Development History

Embedded OpenType (EOT) emerged as an extension of the font format, which was jointly developed by and in the mid-1990s to unify and extend earlier and PostScript-based systems for scalable . provided cross-platform compatibility and advanced typographic features, but its application to web embedding required adaptations to address bandwidth limitations and intellectual property protections for font files. Microsoft introduced EOT in the late , initially for embedding fonts in applications like Word to ensure document fidelity across systems, before adapting it for web use to enable consistent typography on websites without relying on users' installed fonts. This development responded to licensing challenges posed by font foundries, who were wary of unauthorized distribution and enabled by easy font downloads; EOT incorporated mechanisms like subsetting, via MicroType Express, and licensing checks (rootstrings) to enforce end-user license agreements (EULAs) while allowing controlled web deployment. With the release of in 1997, enabled remote font loading via EOT, marking an early milestone in web font technology despite limited due to proprietary tooling and . Seeking broader standardization, submitted the EOT specification to the (W3C) on March 5, 2008, proposing it as a format for web fonts with version identifier 0x00020002, alongside earlier versions 0x00010000 and 0x00020001, emphasizing its decade-long acceptance among font creators. The submission highlighted EOT's roots in but tailored for web efficiency, including compression to reduce file sizes and embedding restrictions to protect foundry interests. However, the W3C rejected EOT as a standard in favor of the (WOFF), citing concerns over its proprietary elements, lack of openness, and insufficient community support, which limited interoperability beyond . By the late , EOT had become largely deprecated, with discontinuing official support for the Web Embedding Fonts Tool (WEFT) used to generate EOT files, reflecting the format's shift to legacy status amid the dominance of WOFF and WOFF2. This marked the culmination of EOT's role as a transitional technology in typography, bridging font embedding practices to more open web standards.

Technical Specifications

File Format Structure

The Embedded OpenType (EOT) file format is structured as a single EMBEDDEDFONT container that encapsulates an font for web embedding, beginning with a header that includes and followed by the font itself. The header starts with essential fields such as EOTSize (4 bytes, total file length including padding), FontDataSize (4 bytes, size of the encapsulated font ), and Version (4 bytes, indicating the format version like 0x00010000 for the initial release or 0x00020002 for versions supporting ). Additional header fields cover font characteristics, including Flags (4 bytes, for options like or ), FontPANOSE (10 bytes, for style classification), Charset (1 byte), Italic (1 byte), Weight (4 bytes), fsType (2 bytes, embedding permissions), and MagicNumber (2 bytes, set to 0x504C for integrity checks). and code page ranges (UnicodeRange1-4 and , each 4 bytes) specify supported character sets, while CheckSumAdjustment (4 bytes) ensures the font's integrity. Version 2.2 (0x00020002) additionally includes fields for End User-Defined Characters (EUDC) support, such as EUDCFontDataSize, EUDCFontData, and EUDCFlags. Variable-length string fields in the header provide naming and licensing details: FamilyName, StyleName, , and FullName (each UTF-16 encoded, with preceding 2-byte size fields). Introduced in version 0x00020001, the RootString (variable bytes, UTF-16 URLs separated by null terminators, sized by RootStringSize) specifies authorized websites for font usage to enforce end-user agreements (EULAs), accompanied by RootStringCheckSum (4 bytes in version 0x00020002) for tamper detection via a byte-sum XOR with 0x50475342. Padding bytes (always 0x0000, typically 2 bytes) follow certain fields, such as after name strings, to maintain 4-byte (long) alignment and ensure compatibility with the underlying sfnt wrapper. The core of the EOT file is the FontData section (variable length), which contains the encapsulated font binary, potentially compressed (e.g., via MicroType Express) and optionally XOR-encrypted with key 0x50 if the corresponding flag is set. This data includes a subset of outlines, metrics, and tables from the original font, supporting both TrueType-based ('glyf' table for quadratic outlines) and PostScript-based ('CFF' table for cubic outlines) representations within the proprietary EOT container. The structure uses little-endian byte order for header fields (except FontData, which follows 's big-endian convention), enabling user agents to validate , decrypt if needed, and render the font while respecting licensing constraints.

Compression and Subsetting

Embedded OpenType (EOT) employs subsetting to minimize sizes by including only the and associated necessary for specific documents or languages, thereby excluding unused characters and reducing . The subsetting process identifies required characters, typically based on the content's range, and removes extraneous from such as 'glyf' (which stores glyph outlines) while updating the 'cmap' table to maintain accurate character-to-glyph mappings for the retained set. This ensures the subsetted font remains fully functional for rendering the targeted text without supporting irrelevant scripts or symbols. Following subsetting, EOT applies using the MicroType Express (MTX) algorithm, a lossless method based on a variation of the Lempel-Ziv (LZ77) with adaptive Huffman encoding, optimized specifically for TrueType-based font data (e.g., using the 'glyf' table for quadratic outlines). The EOT header's 'Flags' field includes the TTEMBED_TTCOMPRESSED bit (0x00000004) to indicate whether the font data is compressed, distinguishing it from uncompressed modes; compressed files store the font data in a compacted form after subsetting. The header also specifies the FontDataSize field, representing the length of this font data in bytes, which aids in and . MTX compression can achieve significant size reductions compared to uncompressed files, depending on the font's complexity and the extent of subsetting.

Tools and Implementation

Web Embedding Fonts Tool

The Web Embedding Fonts Tool (WEFT) served as Microsoft's primary utility for converting and fonts into Embedded OpenType (EOT) format, enabling web authors to create embeddable font objects that rendered consistently in supported browsers. The tool incorporated essential processes such as font subsetting to include only necessary glyphs, to minimize file sizes, and the embedding of root strings to enforce licensing restrictions and prevent unauthorized extraction or modification of the font data. WEFT provided a graphical user interface (GUI) that simplified the workflow, allowing users to select specific glyphs for subsetting, input licensing root strings for security, and generate optimized .eot files ready for web integration. Initially released in the early 2000s, the tool saw its version 3.0 launch on February 26, 2001, followed by version 3.2 on February 25, 2003, which introduced enhanced support for OpenType fonts and improved embedding capabilities. The underlying WEFT technology was also employed in 2007 and 2010 to handle font embedding during presentation saves, exporting fonts as .fntdata files that function as EOT variants with an alternative extension for internal use. Microsoft discontinued WEFT entirely by 2019, ceasing official support and downloads. In its absence, the open-source tool ttf2eot—a port available on since 2013 of a project originating in —emerged as a key alternative for converting TTF/OTF files to EOT, leveraging code from projects like Chromium's utilities.

Browser Support and Usage

Embedded OpenType (EOT) fonts are referenced in web pages using the CSS @font-face rule, where the font source is specified as src: url('font.eot');. This syntax was first introduced by in 1997 as an early implementation of @font-face for web fonts, with EOT-specific support becoming prominent in and later versions. Browser support for EOT is limited exclusively to versions 4 through 11, with no native compatibility in other major browsers such as (versions 12 and later), , , or . As of 2025, 's legacy mode, designed for compatibility with older sites and supported through at least 2029, may render EOT fonts by emulating behavior, though this is not native Edge functionality and requires explicit configuration. For proper serving, EOT files must use the type application/vnd.ms-fontobject to ensure correct handling by supporting browsers. Due to EOT's narrow , developers implement fallback mechanisms in CSS via the font-family , stacking EOT with formats or fonts to guarantee text rendering if the EOT file fails to load or is unsupported. For example, a declaration might read font-family: 'CustomFont', [Arial](/page/Arial), sans-serif;, where 'CustomFont' references the EOT via @font-face, ensuring graceful degradation to widely available fonts. This approach prevents layout issues and maintains readability across diverse browser environments.

Security Concerns

Known Vulnerabilities

One significant vulnerability in Embedded OpenType (EOT) was identified in the Windows kernel-mode drivers, specifically a remote code execution flaw in the parsing of EOT fonts, tracked as CVE-2009-2514. This issue affected Microsoft Windows 2000 Service Pack 4, Windows XP Service Pack 2 and 3, Windows XP Professional x64 Edition Service Pack 2, and Windows Server 2003 Service Pack 2, allowing attackers to gain complete control of affected systems by exploiting improper handling of specially crafted EOT files. The vulnerability stemmed from a buffer overflow in the Win32k.sys driver during the rasterization process, triggered by malformed EOT headers or compressed data sections that led to improper directory entry table construction in kernel mode. Exploitation typically occurred via web-based attacks, where users visiting a malicious site would trigger the font engine in Internet Explorer to process the embedded EOT, or through email attachments containing crafted documents like Word or PowerPoint files that previewed the font. In 2017, researchers at conducted on the EOT format and uncovered additional parsing bugs resulting in memory corruption. One such flaw, CVE-2017-8691, involved an out-of-bounds read in the t2embed.dll library used by , caused by mishandling mutated compressed font data during decompression, potentially enabling remote code execution across supported Windows versions. Another critical issue, CVE-2017-11763, was a due to an in the EOT parser's t2embed!ApplyNameChangeToNameRecords function, where unsanitized name record lengths led to heap-based overflows when processing malformed EOT files in Explorer's font engine. These vulnerabilities highlighted ongoing weaknesses in EOT's compressed data handling and header validation, exploitable through web-embedded fonts on malicious pages targeting the Windows font subsystem. Later in 2017, additional information disclosure vulnerabilities were disclosed in the EOT font engine. CVE-2017-11832 allowed attackers to obtain sensitive information by exploiting improper parsing of specially crafted embedded fonts, affecting SP1, SP2 and R2 SP1, and . Similarly, CVE-2017-11835 enabled potential reading of unintended data through mishandling of embedded fonts in Microsoft Graphics components on the same platforms. In February 2018, addressed further information disclosure issues in the EOT font engine. CVE-2018-0760 involved improper handling of embedded fonts, allowing disclosure of sensitive information on affected systems running SP1, , and Windows Server 2012. CVE-2018-0855 was a related flaw where the EOT engine in SP1 and failed to properly sanitize embedded font data, potentially leaking memory contents.

Mitigation Measures

Microsoft released security updates to address vulnerabilities in the Embedded OpenType (EOT) font engine, including MS09-029 in July 2009, which resolved issues affecting through 8 on and Server 2003 by hardening the font parser against malformed EOT files (KB961371). Subsequent patches, such as MS10-001 (January 2010) and MS10-076 (October 2010, KB982132), further fortified the engine against remote code execution risks in older Windows versions. Starting with and later versions, built-in mitigations like (ASLR) and Data Execution Prevention (DEP) were integrated to reduce exploitation potential without specific EOT-focused patches. The EOT format incorporates design-level mitigations to enhance , including root string verification, where user agents check if the hosting page's matches the authorized domains listed in the EOT's RootString to prevent unauthorized font usage across sites. Additionally, in the EOT header, such as the RootString checksum and overall file integrity checks, allow parsers to detect tampering or corruption by comparing computed values against stored ones during unpacking. Best practices for mitigating risks when using EOT fonts include serving them over HTTPS to protect against man-in-the-middle attacks that could alter font data, validating MIME types (application/vnd.ms-fontobject) at the server to ensure only legitimate EOT files are delivered, and implementing Content Security Policy (CSP) headers to restrict font sources and block potentially unsafe loads in legacy Internet Explorer environments. As of 2025, with no ongoing Microsoft support for EOT-related patching due to the end-of-life status of affected browsers like Internet Explorer, migration to modern formats such as WOFF2 is strongly recommended for secure font embedding.

Legacy and Alternatives

Comparison with Modern Formats

Embedded OpenType (EOT), introduced by in 1997, served as a proprietary solution for web font embedding primarily supported by , limiting its interoperability across browsers. In contrast, the (WOFF), standardized by the W3C in 2012, emerged as an open alternative that addressed EOT's exclusivity by enabling cross-browser support through the CSS3 @font-face rule. While EOT relied on the proprietary MicroType Express (MTX) compression algorithm—a lossless method tailored for and fonts—WOFF employed zlib (Flate) compression applied to individual SFNT tables, resulting in more efficient packaging without vendor-specific dependencies. WOFF2, approved as a W3C Recommendation in 2018, further advanced web font efficiency over both EOT and WOFF by incorporating , which achieves file sizes up to 30% smaller than zlib-compressed equivalents through advanced and preprocessing steps. Unlike EOT, which lacked structured support, WOFF2 includes an optional compressed XML block for details like licensing and vendor information, enhancing transparency and usability. Additionally, EOT's root string mechanism—a embedding binding identifiers to restrict unauthorized font extraction—contrasts with WOFF2's open licensing model, which avoids such proprietary restrictions to promote broader adoption. Key differences highlight EOT's limitations in modern contexts: its subsetting process, reliant on manual tools like Microsoft's Web Embedding Fonts Tool, contrasts with WOFF and WOFF2's compatibility with dynamic subsetting techniques, where tools or services generate character-specific subsets on-the-fly to minimize file sizes. Without advanced algorithms like , EOT files typically result in larger payloads compared to modern formats, impacting . WOFF ultimately succeeded EOT following the W3C's rejection of EOT in 2008 due to concerns over its DRM elements and issues, paving the way for WOFF's integration into CSS3 and widespread browser support.

Current Relevance

Embedded OpenType (EOT) has been deprecated in modern , with no native support in browsers beyond 11. Legacy versions of (12–18), which used the EdgeHTML rendering engine from the initial release in July 2015 with , supported EOT. However, the current Chromium-based , which transitioned to the Blink rendering engine with version 79 in January 2020, does not support EOT, marking the end of practical usability in Microsoft browsers for new projects. Remaining applications of EOT are confined to legacy environments, such as compatibility modes for in enterprise intranets or older systems that mandate IE-specific features for font rendering. In contemporary , its adoption is negligible, as evidenced by the absence of EOT in major font format analyses from the HTTP Archive's 2024 Web Almanac, where it accounts for less than 1% of web font usage across desktop and mobile sites. Experts recommend transitioning from EOT to WOFF2, which offers superior compression, broader browser compatibility, and enhanced security without proprietary restrictions. Tools such as the Font Squirrel Webfont Generator facilitate this migration by allowing conversion of legacy EOT-derived fonts (or their source / equivalents) into WOFF2 and other modern formats, ensuring seamless integration into current web standards.

References

  1. [1]
    Embedded OpenType (EOT) File Format - W3C
    Mar 5, 2008 · The Embedded OpenType File Format (EOT) was developed by Microsoft to enable TrueType and OpenType fonts to be linked to web pages for download ...
  2. [2]
    Brief History of Webfonts article on Typotheque by Peter Biľak
    Oct 22, 2019 · In 1997, Internet Explorer 4 started to support remote font loading via Embedded OpenType (EOT), a font format that Microsoft had developed ...
  3. [3]
    The Decade-Long Path to Web Fonts
    Sep 19, 2017 · Microsoft, on the other hand, chose a format known as Embedded OpenType (EOT), which they had previously used with Microsoft Word and was ...<|control11|><|separator|>
  4. [4]
    EOT Fonts Knowledge Base
    Embedded OpenType (EOT) is a font format for web development, designed for older Internet Explorer versions, and now considered a legacy solution.
  5. [5]
    Microsoft Typography documentation - Typography
    **Summary of Embedded OpenType (EOT) from http://www.microsoft.com/typography/web/embedding/default.aspx:**
  6. [6]
    OpenType overview - Typography - Microsoft Learn
    Jun 9, 2022 · OpenType is a font format developed jointly by Microsoft and Adobe as an extension of Apple's TrueType font format.Missing: Embedded EOT
  7. [7]
    Resources: Font Technology: OpenType - Dalton Maag
    The History and Evolution of OpenType. OpenType was developed jointly by Microsoft and Adobe Systems in the mid-1990s as a successor to their earlier font ...Missing: Embedded | Show results with:Embedded
  8. [8]
    OpenType fonts features | Adobe Type
    OpenType fonts include an expanded character set and typographic layout features, providing broader linguistic support and more precise typographic control.
  9. [9]
    A Note on the Type | MIT Technology Review
    Oct 20, 2009 · EOT, which was developed to embed fonts in Microsoft Office documents, worked as a “wrapper” for desktop font files. It compressed them for ...
  10. [10]
    Say hello to the Web Open Font Format
    Aug 20, 2010 · EOT was not an open standard, was IE-only, and didn't take off; resulting in a rejection by the W3C. Only in relatively recent times, in ...
  11. [11]
    Progress on smaller and more colorful fonts - LWN.net
    Nov 13, 2013 · But the EOT submission to the W3C never garnered outside support, and WOFF beat it handily. Years later when the chromatic font discussions ...
  12. [12]
    Embedded OpenType - Just Solve the File Format Problem
    Dec 28, 2023 · Embedded OpenType (EOT) is an outline font format developed by Microsoft. ... Specifications. Embedded OpenType File Format (W3C submission, 2008- ...
  13. [13]
    OpenType font file - Microsoft Typography
    May 29, 2024 · An OpenType font file contains data, in table format, used for rendering of text. Portions of the data are used by applications to calculate the layout of text ...Filenames · Data TypesMissing: EOT | Show results with:EOT
  14. [14]
    Generate subsets of fonts or optimize file sizes
    The subsetted glyph set is based on the specified glyphs or characters, and specified OpenType layout features. The tool also performs some size-reducing ...
  15. [15]
    MicroType® Express (MTX) Font Format - W3C
    Mar 5, 2008 · The MicroType Express font compression technology for OpenType TrueType fonts was designed to minimize memory usage for font data storage in resource- ...Missing: EOT | Show results with:EOT
  16. [16]
  17. [17]
    fontello/ttf2eot: Font convertor, TTF to EOT, for node.js - GitHub
    Open Source. GitHub Sponsors. Fund open source developers · The ReadME Project ... ttf2eot converts TTF fonts to EOT format. That can be useful for ...
  18. [18]
    @font-face | CSS-Tricks
    Apr 22, 2025 · EOT: (Embedded OpenType): An outdated format used exclusively for Internet Explorer. SVG: It is a vector-based font format and is primarily ...
  19. [19]
    EOT - Embedded OpenType fonts | Can I use... Support ... - CanIUse
    Type of font that can be derived from a regular font, allowing small files and legal use of high-quality fonts. Usage is restricted by the file being tied to ...
  20. [20]
    Internet Explorer mode in Microsoft Edge
    Note: Support for Internet Explorer ended on June 15, 2022. Organizations can configure IE mode for their users through an Enterprise Site List. Learn more. To ...
  21. [21]
    Common media types - HTTP - MDN Web Docs
    Jul 4, 2025 · Common media types ;.eot, MS Embedded OpenType fonts, application/vnd.ms-fontobject ;.epub, Electronic publication (EPUB), application/epub+zip.
  22. [22]
    Microsoft Security Bulletin MS09-065 - Critical
    The Web Embedding Fonts Tool (WEFT) lets Web authors create font objects that are linked to their Web pages so that when viewed through the browser, pages ...
  23. [23]
    A 14-day Journey through Embedded Open Type Font Fuzzing
    Oct 19, 2017 · In this blog post we would like to share how we discovered multiple Embedded Open Type (EOT) font vulnerabilities by using a combination of dumb and ...Missing: licensing encrypted
  24. [24]
  25. [25]
  26. [26]
    WOFF File Format 1.0 - W3C
    Dec 13, 2012 · This document specifies the WOFF font packaging format. This format was designed to provide lightweight, easy-to-implement compression of font data.5. Table Directory · 7. Extended Metadata Block · Appendix A: Extended...
  27. [27]
    WOFF File Format 2.0 - W3C
    Aug 8, 2024 · ... reduce the compressed data size by 5-10%. However, the CFF de-subroutinization will, at the same time, increase the output file size by ~10%.
  28. [28]
    CDN Guide » Compression - CDN Planet
    Nov 23, 2022 · Brotli does a 10% to 30% better job at reducing file size than Gzip. The larger the file, the better Brotli performs.
  29. [29]
    For and against standardizing font embedding - W3C
    A report on the opinions for and against standardizing EOT, in view of starting a W3C WG in October 2008.1. The Facts · 2. The Controversy · Access Control Via Http...
  30. [30]
    Dynamic subsetting & web font serving - Adobe Help Center
    Nov 16, 2022 · Because dynamic subsetting is required to serve these fonts, you can only add them to an existing web project if it already uses dynamic ...
  31. [31]
    Fonts | 2024 | The Web Almanac by HTTP Archive
    Nov 11, 2024 · WOFF2 is by far the most popular format for web fonts, being used on 81% of desktop and 78% of mobile websites. This marks an increase of three ...
  32. [32]
    Create Your Own @font-face Kits - Font Squirrel
    BASIC. Straight conversion with minimal processing. OPTIMAL. Recommended settings for performance and speed. ; Font Formats: TrueType. WOFF WOFF2, EOT Lite EOT ...