Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-2468 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Office

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
9.3CRITICALNVD
EPSS
71.8%
top 1.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Microsoft OfficeMicrosoft Sharepoint ServerMicrosoft Word+2 more
Timeline
PublishedAug 15
Latest updateMay 14

Description

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages5 packages

▶NVDmicrosoft/word2007, 2010, 2013+2
▶NVDmicrosoft/office2010, 2011, 2016+2
▶NVDmicrosoft/sharepoint_server2010, 2013+1

🔴Vulnerability Details

2
GHSA
GHSA-hp9m-q32j-5m4m: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibili↗2022-05-14
▶
CVEList
CVE-2015-2468: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibili↗2015-08-15
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Office 2007 - 'mso.dll' Arbitrary Free (MS15-081)↗2015-08-21
▶
CVE-2015-2468 — Microsoft Office vulnerability | cvebase