CVE-2015-6172

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers…

published December 9, 2015

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
54%
Percentile
99.0
In the wild
Unconfirmed
What it is

⚠️ A crafted email could open the door to chaos! This Microsoft Office RCE vulnerability lets attackers execute arbitrary code via a manipulated message in Outlook, leaving a suspicious path for intruders. 🔥 Think of your inbox as a busy café. A cleverly disguised order slips past the barista, and suddenly, the wrong drink is made for the whole shop, leading to chaos! That's exactly how this flaw lets attackers sneak in and run their own code, all while you're unsuspecting. If an attacker successfully exploits this vulnerability, they could execute malicious code on your system, potentially leading to data theft, system corruption, or even a full takeover. It’s like giving a stranger the keys to your whole café and letting them decide the menu!

Put simply

Think of your inbox as a busy café. A cleverly disguised order slips past the barista, and suddenly, the wrong drink is made for the whole shop, leading to chaos! That's exactly how this flaw lets attackers sneak in and run their own code, all while you're unsuspecting. This vulnerability exists in Microsoft Word and allows remote attackers to execute arbitrary code by sending a specially crafted email message processed by Outlook. Essentially, Outlook trusts the content of the email without proper validation, creating a security loophole.

What to do

If an attacker successfully exploits this vulnerability, they could execute malicious code on your system, potentially leading to data theft, system corruption, or even a full takeover. It’s like giving a stranger the keys to your whole café and letting them decide the menu! To protect yourself, ensure you're running the latest versions of Microsoft Office or apply any available patches. Be cautious about opening unexpected emails or messages, particularly with attachments. Regularly update your security software to detect possible threats. You've got this! Stay vigilant, keep your software updated, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.53815 · 99.0th percentile
Published
2015-12-09T11:00Z
EPSS history
Timeline
  • 09 DEC 11:00Z
    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers…
    cvelistv5