CVE-2015-1641
Microsoft Office Memory Corruption Vulnerability
Description
CVE-2015-1641 is a high-severity memory corruption vulnerability in Microsoft Office caused by improper handling of rich text format (RTF) files in memory. The flaw allows a remote attacker to execute arbitrary code in the context of the current user by convincing them to open a specially crafted RTF document. CISA has confirmed active exploitation by adding this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 93.62% (99.8th percentile), CVE-2015-1641 is among the most likely exploited vulnerabilities, affecting Microsoft Word, Office, SharePoint Server, and Office Web Apps across multiple versions.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2010 |
| microsoft | office compatibility pack | - |
| microsoft | office web apps | 2010; 2013 |
| microsoft | outlook | 2011 |
| microsoft | sharepoint server | 2010; 2013 |
| microsoft | word | 2007; 2010; 2011; 2013 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/73995(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032104(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1641(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability where software writes data beyond the intended buffer boundaries. In CVE-2015-1641, Microsoft Office fails to properly handle RTF files in memory, resulting in an out-of-bounds write condition that allows attackers to corrupt memory and achieve arbitrary code execution when a user opens a maliciously crafted RTF document.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2015-1641 carries a CVSS 3.1 score of 7.8 (HIGH), representing a significant security risk for organizations using affected Microsoft Office products. The vulnerability requires local exploitation with low attack complexity, typically triggered when a user opens a malicious RTF document. No privileges are required from the attacker, though user interaction is mandatory. Successful exploitation delivers full impact across confidentiality, integrity, and availability, enabling the attacker to execute arbitrary code with the same permissions as the current user. The EPSS score of 93.62% in the 99.8th percentile confirms exceptionally high exploitation probability, and the broad range of affected products including Word, Office, SharePoint Server, and Office Web Apps significantly increases the organizational attack surface.
Exploit Maturity
CVE-2015-1641 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 93.62% (99.8th percentile) indicates near-certain active exploitation, placing this vulnerability among the most targeted by threat actors. The exploitation relies on crafted RTF documents, a vector that has proven highly effective in spear-phishing campaigns targeting enterprise environments. This vulnerability has been widely used in the wild since its disclosure in April 2015 and remains a favored tool in the arsenals of advanced persistent threat (APT) groups and cybercriminal operations.
Remediation
- Apply Microsoft security bulletin MS15-033 immediately as mandated by the CISA KEV catalog. Install patches from the Microsoft Security Updates for all affected products.
- Verify that all instances of affected products have been updated, including Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1.
- Configure Microsoft Office to block RTF content by setting the file-block policy through Group Policy or the Trust Center settings, preventing the opening of RTF files until patching is complete.
- Implement email gateway filtering to detect and quarantine RTF attachments, particularly those originating from external or untrusted sources, as this is the primary delivery mechanism for exploitation.
- Monitor for indicators of compromise including unexpected child processes spawned by Word or Office applications, suspicious RTF file processing events, and anomalous network connections originating from Office processes.
Technical Details
CVE-2015-1641 is a memory corruption vulnerability triggered when Microsoft Word improperly handles a specially crafted RTF file. The underlying flaw is an out-of-bounds write that occurs during the parsing of RTF content, where malformed data structures cause the application to write data beyond allocated memory boundaries, enabling an attacker to overwrite critical memory structures and redirect execution flow. The CVSS vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local exploitation through document opening with low complexity, requiring no attacker privileges but mandatory user interaction. The vulnerability affects Word Automation Services on SharePoint Server and Office Web Apps Server in addition to desktop Office applications, meaning exploitation can potentially occur in automated document processing pipelines as well as through direct user interaction.
Frequently Asked Questions
Is CVE-2015-1641 being actively exploited?
Yes. CVE-2015-1641 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.62% (99.8th percentile) further confirms near-certain exploitation activity, making this a high-priority patching target.
What products are affected by CVE-2015-1641?
CVE-2015-1641 affects Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1.
How do I fix CVE-2015-1641?
Apply Microsoft security bulletin MS15-033 for all affected products. As an interim mitigation, configure Office to block RTF content via file-block policies and implement email filtering to quarantine suspicious RTF attachments from external sources.
How severe is CVE-2015-1641?
CVE-2015-1641 has a CVSS 3.1 score of 7.8 (HIGH). With an EPSS score in the 99.8th percentile and confirmed active exploitation in targeted attack campaigns, this is an extremely severe vulnerability requiring immediate remediation across all affected Office installations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.