CVE-2015-2425highunder attackCWE-787

CVE-2015-2425

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 45%
from disclosure to weapon
Published on NVDJul 14
CISA KEV+2507d
Action required by CISAfederal deadline: 2022-06-15

Apply updates per vendor instructions.

In short

Internet Explorer 11 can crash or run malicious code when you visit a specially crafted website. This happens because the browser doesn't properly handle memory, allowing attackers to take control of your computer.

Technical detail

CVE-2015-2425 is a heap-based buffer overflow (CWE-787) in Internet Explorer 11's memory management. Remote attackers can trigger arbitrary code execution or denial of service by hosting a malicious webpage that the victim visits; no user interaction beyond visiting the site is required, and the vulnerability affects the browser's core rendering engine.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a