CVE-2015-1650

Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility…

published April 14, 2015

CVSS
—
EPSS
29%
Percentile
98.2
In the wild
Unconfirmed
What it is

🚨 A crafty crafted Office document could pull off a successful remote code execution dance in Microsoft Word! 🔥 Think of it like a restaurant that serves a dish with a hidden ingredient that, once consumed, gives the diner secret access to the kitchen. This use-after-free vulnerability allows attackers to exploit it, much like bypassing security to access private areas in a kitchen without a trace! An attacker could create a specially crafted document that, when opened, allows them to execute arbitrary code on the victim's machine. This means they could potentially steal data or manipulate files, which could lead to devastating consequences for users and organizations alike!

Put simply

Think of it like a restaurant that serves a dish with a hidden ingredient that, once consumed, gives the diner secret access to the kitchen. This use-after-free vulnerability allows attackers to exploit it, much like bypassing security to access private areas in a kitchen without a trace! This vulnerability in Microsoft Word occurs when an object is used after it has been freed in memory, allowing attackers to execute arbitrary code through malicious Office documents.

What to do

An attacker could create a specially crafted document that, when opened, allows them to execute arbitrary code on the victim's machine. This means they could potentially steal data or manipulate files, which could lead to devastating consequences for users and organizations alike! To protect yourself, ensure that you’re running the latest supported versions of Microsoft Word and apply any available security updates. Educate users about the dangers of opening unexpected documents from unknown sources. 🔒 You've got this! Stay vigilant, follow these steps, and you'll keep your Word documents safe and sound! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.28839 · 98.2th percentile
Published
2015-04-14T20:00Z
EPSS history
Timeline
  • 14 APR 20:00Z
    Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility…
    cvelistv5