CVE-2015-2510

published 2015-09-09

CVE-2015-2510: Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync…

Priority P2 70 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability."

Affected

5 ranges

Vendor	Product	Version range	Fixed in
microsoft	live_meeting_console	—	—
microsoft	lync	—	—
microsoft	lync	—	—
microsoft	office	—	—
microsoft	office	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename 3013413838_orig.xls↗

filename 3013413838_crash.xls↗

filename 3013413838_min.xls↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38217.zip↗

path OGL.dll↗

process OGL!ValidateBitmapInfo↗

• → The vulnerability is triggered via a crafted XLS file delivered to Microsoft Office 2007 Excel; monitor for Excel processing XLS files that cause OGL.dll to crash in ScanOperation::Convert_24_sRGB. ↗
• → The one-bit delta in the malicious XLS file occurs at file offset 0x139F; this byte offset can be used as a static signature anchor when scanning suspicious XLS files. ↗
• → Crash manifests as an invalid memory dereference (out-of-bounds read/write) inside OGL!ScanOperation::Convert_24_sRGB called from OGL!EpAlphaBlender::Blend; look for access violations in OGL.dll version 12.0.6719.5000 under Excel.exe. ↗
• → The root cause is missing bounds/overflow checks in OGL!ValidateBitmapInfo; an imul result added to a base heap pointer produces an out-of-bounds pointer stored into the bitmap info structure, enabling later out-of-bounds write when the 0x13350 stride value grows to 0x27fd0. ↗
• → Disabling Microsoft Office File Validation Add-In is a prerequisite observed in the PoC; detections should flag Office processes with file validation disabled processing external XLS files. ↗

• · The crash was only reproducible in Office 2007 (Excel.exe 12.0.6718.5000, OGL.dll 12.0.6719.5000); it did not reproduce in Office 2010 or 2013, limiting the scope of detection rules targeting this specific code path. ↗
• · Application Verifier was required to observe the crash reliably; in production environments without heap instrumentation the crash may manifest differently or be harder to detect. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119