High severity · published Jul 14, 2015
CVE-2015-2424
Microsoft PowerPoint Memory Corruption Vulnerability
In wildKEV
8.8
CVSS
40.4%
EPSS
Yes
On KEV
Description
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)40.4% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Microsoft
2007; 2010; 2011; 2013; 2013 · source: NVD
EV
Excel Viewer · Microsoft
2007 · source: NVD
OC
Office Compatibility Pack · Microsoft
All versions, or not specified · source: NVD
PO
Powerpoint · Microsoft
2007; 2010 · source: NVD, KEV
WO
Word · Microsoft
2013 · source: NVD
WV
Word Viewer · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2424
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securitytracker.com/id/1032899
vendor-advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070
More from Office
9.8
CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability