CVE-2015-1641KEV · OVERDUE

Microsoft Office Memory Corruption Vulnerability

High · published April 14, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
97%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 Just by opening a rogue RTF document, an attacker can execute arbitrary code on your system! This vulnerability in Microsoft Office is a ticking time bomb! 🔥 Think of it as a trusted hotel sending out beautifully designed invitations for a party, but hidden inside is a trapdoor that lets an intruder access the guest rooms. If you aren't careful about which invitations you accept, you might end up in a big mess! This vulnerability allows hackers to take control of your system remotely, potentially leading to data breaches, loss of sensitive information, or even complete system compromise. It’s absolutely devastating to think that a simple document can open the door to such chaos!

Put simply

Think of it as a trusted hotel sending out beautifully designed invitations for a party, but hidden inside is a trapdoor that lets an intruder access the guest rooms. If you aren't careful about which invitations you accept, you might end up in a big mess! The Microsoft Office Memory Corruption Vulnerability occurs when the application improperly handles RTF documents, allowing an attacker to run arbitrary code if the user opens a specially crafted file.

What to do

This vulnerability allows hackers to take control of your system remotely, potentially leading to data breaches, loss of sensitive information, or even complete system compromise. It’s absolutely devastating to think that a simple document can open the door to such chaos! To keep your system safe, update to the latest versions of Microsoft Word and Office applications. Ensure all your software is up to date, and educate users to be cautious with unexpected RTF documents. Do this ASAP! 🛡️ You've got this! By taking these steps, you'll protect yourself and your organization from potential threats! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.97246 · 99.9th percentile
Published
2015-04-14T20:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 14 APR 20:00Z
    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation…
    cvelistv5