CVE-2015-0071: Internet Explorer ASLR bypass via crafted web site

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is listed in CISA KEV with confirmed exploitation and a high EPSS percentile, though it is an ASLR bypass that requires a separate memory-corruption flaw for full compromise.

What it is

Internet Explorer 9 through 11 fails to properly randomize memory layout, allowing a crafted web site to bypass ASLR. This weakens a core exploit mitigation, making memory-corruption bugs in IE or its components far easier to turn into reliable code execution.

Impact

An attacker gains the ability to defeat address space layout randomization, removing a key obstacle to exploiting memory corruption and enabling reliable code execution in the browser context.

Attack surface

Reached remotely over the network by luring a user to a crafted web site; no authentication is required but user interaction (visiting the page) is needed per the CVSS vector AV:N/AC:L/PR:N/UI:R.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-05-25, indicating real-world exploitation, and EPSS gives a 30-day probability of 0.33581 (98.3rd percentile); no ransomware campaign use is documented.

What to do

• Apply the Microsoft MS15-009 security update to affected Internet Explorer versions.
• Retire or migrate off Internet Explorer 9 through 11 where possible, as the product is end-of-life.
• Enforce EMET or OS-level exploit mitigations such as Force ASLR and mandatory ASLR on legacy hosts.
• Restrict browsing to trusted sites and block untrusted ActiveX/script content via policy.
• Track CISA KEV remediation due date of 2022-06-15 and confirm patched status on all remaining IE hosts.

Detection

• Monitor for IE processes spawning unexpected child processes or loading unusual modules after web browsing.
• Alert on crashes in mshtml.dll or other IE components that may indicate exploitation attempts.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains visited by IE users.
• Audit endpoint inventory for hosts still running Internet Explorer 9 through 11 and flag them as unpatched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.