CVE-2015-1641: Microsoft Office Word RTF out-of-bounds write memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with a very high EPSS score and allows remote code execution, though exploitation requires user interaction to open a crafted document.

What it is

Microsoft Word and related Office components (Word 2007/2010/2013, Word for Mac 2011, Office Compatibility Pack, Word Automation Services, Office Web Apps) contain an out-of-bounds write (CWE-787) that is triggered when parsing a crafted RTF document. Successful exploitation allows arbitrary code execution in the context of the opening user. The flaw is old but remains actively exploited and is listed in CISA KEV, so unpatched Office installations are still at real risk.

Impact

An attacker who gets a victim to open a malicious RTF document can execute arbitrary code with the privileges of the logged-on user, potentially leading to full system compromise.

Attack surface

Reached locally by opening a crafted RTF file in a vulnerable Office product; the CVSS vector (AV:L/UI:R) indicates user interaction is required and no privileges are needed. No authentication is required, but the victim must open or preview the malicious document.

Exploitation

CVE-2015-1641 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.96758 (99.884th percentile), indicating observed exploitation and very high likelihood of attempted exploitation. No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft MS15-033 security update to all affected Office, Word, SharePoint, and Office Web Apps installations.
• Disable or restrict opening of untrusted RTF documents and block RTF content in email attachments where business needs allow.
• Enable Microsoft Office Protected View and File Block settings for legacy formats to reduce exposure to malicious documents.
• Keep Office and Windows fully patched and remove or upgrade end-of-life products such as Office 2007, Office 2010, and Word for Mac 2011.
• Segment and monitor systems that must process untrusted documents, and restrict user privileges to limit post-exploitation impact.

Detection

• Monitor for Office processes (WINWORD.EXE, OUTLOOK.EXE) spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Hunt for RTF files with embedded objects or unusual OLE structures delivered via email or downloaded from the web.
• Review endpoint telemetry for suspicious file writes or memory corruption crashes in Office applications.
• Alert on known exploitation indicators and correlate with CISA KEV guidance for CVE-2015-1641.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.