⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2015-1641 — Out-of-bounds Write in Microsoft Office

CWE-787 — Out-of-bounds WriteCWE-39913 documents10 sources
Severity
7.8HIGHNVD
EPSS
93.6%
top 0.16%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
5
Microsoft OfficeMicrosoft Office WEB AppsMicrosoft Outlook+2 more
Timeline
PublishedApr 14
KEV addedNov 3
KEV dueMay 3
Latest updateJan 27
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDmicrosoft/word4 versions+3
▶NVDmicrosoft/office_web_apps2010, 2013+1
▶NVDmicrosoft/sharepoint_server2010, 2013+1

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-7p4q-fv59-h67q: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Autom↗2022-05-14
▶
CVEList
CVE-2015-1641: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Autom↗2015-04-14
▶
VulnCheck
Microsoft Office Memory Corruption Vulnerability↗2015
▶

🔍Detection Rules

1
Suricata
ET HUNTING Microsoft Office Memory Corruption (CVE-2015-1641)↗2025-01-27
▶

📋Vendor Advisories

1
CISA
Microsoft Office Memory Corruption Vulnerability↗2021-11-03
▶

🕵️Threat Intelligence

1
Fortinet
In-Depth Look at New Variant of MONSOON APT Backdoor, Part 1↗2017-04-05
▶
CVE-2015-1641 — Out-of-bounds Write in Microsoft Office | cvebase