CVE-2015-1641highunder attackCWE-787

CVE-2015-1641

Published · Updated

Follow this CVE+ Monitor Microsoft Office

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 3 threat group(s) use it.

ssvc Actcvss 7.8epss 97%
from disclosure to weapon196 days
Published on NVDApr 14
1st PoC+196d
CISA KEV+2395d
Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT41🇨🇳 MITRE ATT&CK
APT / StateConfucius MITRE ATT&CK
APT / StatePatchwork🇮🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Microsoft Word allows attackers to run malicious code on your computer by sending a specially crafted document in RTF format. Opening the document is enough to trigger the attack.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in RTF document parsing across multiple Microsoft Office products. Remote code execution is achieved through a maliciously crafted RTF file; user interaction (opening the document) is required. Affects Word 2007-2013, Office 2010-2013, SharePoint, and Office Web Apps Server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.