CVE-2015-2424KEV · OVERDUE

Microsoft PowerPoint Memory Corruption Vulnerability

High · published July 14, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
8.8
EPSS
40%
Percentile
98.6
In the wild
Confirmed
What it is

🚨 A crafted Office document is the key to unlocking chaos! This vulnerability lets remote attackers execute code or crash your system. 🔥 Think of it like a well-disguised parcel that, once opened, spills out all sorts of unexpected contents — some of which could wreak havoc in your office! An attacker could exploit this vulnerability to run malicious code directly on your machine, leading to data theft, system crashes, or worse. It's like giving someone the keys to your office and letting them rearrange everything — except they might not stop at just moving your stapler!

Put simply

Think of it like a well-disguised parcel that, once opened, spills out all sorts of unexpected contents — some of which could wreak havoc in your office! This memory corruption vulnerability in Microsoft PowerPoint and Word allows attackers to run arbitrary code by exploiting specially crafted documents, resulting in either execution of malicious commands or denial of service through system instability.

What to do

An attacker could exploit this vulnerability to run malicious code directly on your machine, leading to data theft, system crashes, or worse. It's like giving someone the keys to your office and letting them rearrange everything — except they might not stop at just moving your stapler! Immediately patch your Microsoft Office installations to the latest versions to close this vulnerability. Also, educate users about not opening unknown documents and consider implementing stricter security measures for document handling. 🛡️ You've got this! With a few quick updates and a bit of vigilance, you can keep your systems safe from this threat! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.40388 · 98.6th percentile
Published
2015-07-14T21:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 14 JUL 21:00Z
    Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote…
    cvelistv5