Actively exploited · Published Apr 14, 2015 · Assigned by microsoft

CVE-2015-1641

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in Office from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 97.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)97.2%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

1032104 vdb-entry, x_refsource_SECTRACK
73995 vdb-entry, x_refsource_BID
MS15-033 vendor-advisory, x_refsource_MS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1641 government-resource