CVE-2015-1642highunder attackCWE-787

CVE-2015-1642

Published · Updated

Follow this CVE+ Monitor Microsoft Office

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 53%
from disclosure to weapon
Published on NVDAug 15
CISA KEV+2392d
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A flaw in Microsoft Office versions 2007, 2010, and 2013 allows attackers to run malicious code on a computer when a user opens a specially crafted document. This is dangerous because the attacker gains full control of the victim's system.

Technical detail

Memory corruption vulnerability in Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 that allows remote code execution when processing malformed documents. The attack vector is user interaction (opening a crafted file); no authentication or special privileges are required. The vulnerability results in arbitrary code execution with the privileges of the user running Office.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a