CVE-2015-2431

published 2015-08-15

CVE-2015-2431: Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lync Basic 2013 SP1 allow remote attackers…

Priority P2 67 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lync Basic 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office Graphics Library (OGL) font, aka "Microsoft Office Graphics Component Remote Code Execution Vulnerability."

Affected

4 ranges

Vendor	Product	Version range	Fixed in
microsoft	live_meeting	—	—
microsoft	lync	—	—
microsoft	lync_basic	—	—
microsoft	office	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37911.zip↗

path OGL.dll↗

• → Trigger is a crafted .doc file exploiting OGL.dll (Office Graphics Library) via a malformed OLE Structured Storage entry. The fuzzing delta is a 1-bit change at file offset 0x4A45 in the OLESSRoot.DirectoryEntries[100].OLESSDirectoryEntry[20].sidLeft field (original 0x00000000 → fuzzed 0x00008000). ↗
• → Crash manifests as an out-of-bounds write inside OGL!DpOutputSpanStretch::OutputSpan+0x13e (instruction: mov dword ptr [edx+ebx],ecx). Monitor for heap corruption or AV exceptions originating from OGL.dll during Office document rendering. ↗
• → The vulnerable call stack passes through OGL!DpDriver::DrawImage → OGL!RasterizePath → OGL!RasterizeEdges → OGL!EpAntialiasedFiller chain. Detecting crashes or exceptions in this call chain within WINWORD.EXE/LYNC.EXE process space is indicative of exploitation attempts. ↗
• → Vulnerable OGL.dll version is 12.0.6719.5000 (Office 2007 SP3). Presence of this specific version on a host combined with processing of untrusted .doc files should be treated as high-risk. ↗

• · The PoC was reproduced with Microsoft Office File Validation Add-In explicitly disabled; environments with the add-in enabled may not trigger the crash in the same way. ↗
• · The debugger breakpoint address (0x3bdb946d) and all crash-site addresses are module-relative for OGL.dll version 12.0.6719.5000 on x86; they will differ across OS/patch levels and must be recalculated for other environments. ↗
• · Two DpOutputSpanStretch objects are created before the crash, and OutputSpan is called twice on the second object before the crashing iteration; detection logic must account for this multi-call sequence to avoid false negatives. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20