CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
Description
CVE-2015-1671 is a remote code execution vulnerability that exists when components of Microsoft Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts. An attacker who successfully exploits this vulnerability can execute arbitrary code on the affected system with the privileges of the current user. The vulnerability can be triggered through specially crafted documents, web pages, or any content that embeds TrueType fonts. CISA has listed CVE-2015-1671 in the Known Exploited Vulnerabilities catalog, confirming active exploitation, and its EPSS percentile of 99.4% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | .net framework | 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 3.5.1; 3.5 |
| microsoft | live meeting | 2007 |
| microsoft | lync | 2010; 2013 |
| microsoft | silverlight | 5.0 |
References
- http://www.securityfocus.com/bid/74490(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032281(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1671(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2015-1671 in the NVD database. The vulnerability involves improper handling of TrueType fonts across multiple Microsoft products. When the font rendering engine processes a specially crafted TrueType font, it fails to properly validate font data structures, leading to memory corruption that enables arbitrary code execution. This weakness class relates to insufficient input validation in font parsing, a common attack surface across operating systems and applications that render text.
Learn more: CWE Overview
Impact Analysis
CVE-2015-1671 allows remote code execution through improper TrueType font handling across a wide range of Microsoft products. The vulnerability is remotely exploitable through web pages, documents, or any content embedding crafted fonts. Confidentiality (High): Successful exploitation gives the attacker code execution rights matching the current user, enabling access to all user-accessible data including documents, credentials, and email. In scenarios where font processing occurs with kernel privileges, the impact extends to all system data. Integrity (High): Arbitrary code execution allows installation of malware, modification of system files, and creation of persistent backdoors. Availability (High): The attacker can crash the system, deploy ransomware, or render applications inoperable. With an EPSS percentile of 99.4%, this vulnerability has near-certain exploitation activity. The broad attack surface across Windows, .NET, Office, Lync, and Silverlight significantly amplifies the risk, as multiple entry points exist for exploitation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2015-1671 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 15, 2022. The EPSS percentile of 99.4% places this vulnerability among the most actively exploited, indicating near-certain exploitation activity. TrueType font parsing vulnerabilities affecting multiple Microsoft components have historically been high-priority targets for advanced threat actors, as they can be delivered through numerous channels (web pages, Office documents, email) and the font rendering engine has historically operated with elevated privileges in the Windows graphics subsystem.
Remediation
- Apply Microsoft security updates per vendor instructions as required by the CISA KEV catalog. Install patches for all affected components: Windows, .NET Framework, Office, Lync, and Silverlight.
- Ensure all affected Microsoft products are updated across the entire organization. The broad scope of this vulnerability (Windows, .NET, Office, Lync, Silverlight) means patches must be applied to multiple products on each system.
- Remove end-of-life products such as Microsoft Silverlight (support ended October 2021) and Lync (replaced by Skype for Business, now Microsoft Teams). Eliminating unused attack surface is the most effective mitigation.
- Block untrusted font loading on Windows 10 and later using the "Untrusted Font Blocking" Group Policy, which prevents loading fonts from outside the trusted fonts directory.
- Deploy document and email security solutions that can detect and sanitize malicious embedded fonts in Office documents and email attachments before they reach end users.
Technical Details
CVE-2015-1671 is a memory corruption vulnerability in the TrueType font rendering engine shared across multiple Microsoft products including Windows, .NET Framework, Office, Lync, and Silverlight. The vulnerability occurs when the font engine processes a specially crafted TrueType font file (.ttf) and fails to properly validate font table data. Malformed font structures cause the parser to corrupt memory, enabling an attacker to execute arbitrary code. The broad scope of affected products reflects the shared font rendering infrastructure across the Microsoft software ecosystem. The font engine is invoked whenever text is rendered using a custom font, which can occur through web pages (embedded web fonts), Office documents, email messages, and any application that displays text with custom typography. In affected Windows versions, parts of the font rendering pipeline operate in kernel mode through the win32k.sys driver, potentially enabling kernel-level code execution if the vulnerability is triggered through that code path.
Frequently Asked Questions
Is CVE-2015-1671 being actively exploited?
Yes, CVE-2015-1671 is actively exploited. CISA confirmed its inclusion in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. The EPSS percentile of 99.4% indicates near-certain exploitation activity.
What products are affected by CVE-2015-1671?
CVE-2015-1671 affects a wide range of Microsoft products: Windows, .NET Framework, Microsoft Office, Microsoft Lync, and Microsoft Silverlight. All share the vulnerable TrueType font rendering component. Organizations must patch all affected products to fully mitigate the vulnerability.
How do I fix CVE-2015-1671?
Apply Microsoft security patches for all affected products (Windows, .NET, Office, Lync, Silverlight). Remove end-of-life products like Silverlight. Enable untrusted font blocking on Windows 10 and later. Deploy document security solutions to detect malicious embedded fonts.
How severe is CVE-2015-1671?
CVE-2015-1671 is a remote code execution vulnerability with an EPSS percentile of 99.4%, indicating near-certain exploitation. The exceptionally broad attack surface across five Microsoft product families and multiple delivery vectors (web, documents, email) makes it a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.