CVE-2015-1770KEV · OVERDUE

Microsoft Office Uninitialized Memory Use Vulnerability

High · published June 10, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.4th percentile for exploit probability.

1649
days past CISA
deadline
CVSS v3.1
8.8
EPSS
35%
Percentile
98.4
In the wild
Confirmed
What it is

🚨 A single crafted Office document could let attackers run wild on your system! This Microsoft Office vulnerability is like a sneaky thief slipping in through an unlocked window. 🔥 Think of it as an uninvited guest crashing a party – they can take over the music, rearrange the furniture, or even steal valuables without anyone noticing. This vulnerability allows attackers to mess around with your system just like that! An attacker could exploit this vulnerability to execute arbitrary code, potentially gaining control of your device. This means they could access sensitive documents, install malware, or even manipulate your system settings – a nightmare scenario for any user!

Put simply

Think of it as an uninvited guest crashing a party – they can take over the music, rearrange the furniture, or even steal valuables without anyone noticing. This vulnerability allows attackers to mess around with your system just like that! This vulnerability arises from uninitialized memory use in Microsoft Office 2013 SP1 and 2013 RT SP1, which allows remote attackers to execute arbitrary code via a maliciously crafted Office document.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, potentially gaining control of your device. This means they could access sensitive documents, install malware, or even manipulate your system settings – a nightmare scenario for any user! To safeguard your system, immediately update Microsoft Office to the latest version. Ensure that all security patches are applied and educate users about the dangers of opening unknown documents. Regularly back up important data, just in case! You've got this! Stay vigilant and keep your software updated, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.34995 · 98.4th percentile
Published
2015-06-10T01:00Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 10 JUN 01:00Z
    Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized…
    cvelistv5