CVE-2015-2502highunder attackCWE-787

CVE-2015-2502

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 51%
from disclosure to weapon
Published on NVDAug 19
CISA KEV+2429d
Action required by CISAfederal deadline: 2022-05-04

Apply updates per vendor instructions.

In short

Internet Explorer versions 7 through 11 have a flaw that allows attackers to run malicious code or crash the browser by visiting a specially crafted website. This vulnerability was actively exploited by criminals in August 2015.

Technical detail

A memory corruption vulnerability in Internet Explorer 7-11 (CWE-787: out-of-bounds write) can be triggered remotely via a malicious web page, allowing arbitrary code execution or denial of service. The attack vector is network-based and requires only user interaction (visiting the malicious site); no authentication or special privileges are needed.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a