CVE-2015-1642: Microsoft Office memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityRemote code execution via document open, KEV-listed, and very high EPSS, though it requires user interaction and affects older Office versions.

What it is

Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 contain an out-of-bounds write (CWE-787) that lets a remote attacker execute arbitrary code through a crafted document. The flaw is a memory corruption issue in document parsing, so opening a malicious file can compromise the host. It matters because Office documents are routinely exchanged and the vulnerability is listed in CISA KEV.

Impact

An attacker who gets a crafted document opened gains arbitrary code execution in the context of the Office process, which can lead to full system compromise.

Attack surface

Reached locally by opening a malicious document; the CVSS vector shows UI:R, so user interaction is required, and PR:N means no prior authentication is needed.

Exploitation

CVE-2015-1642 is in CISA KEV (added 2022-03-03) and has a high EPSS 30-day probability of 0.53213 (99th percentile), indicating observed exploitation and elevated risk.

What to do

• Apply the Microsoft MS15-081 security update to affected Office 2007 SP3, 2010 SP2, and 2013 SP1 installations.
• Prioritize patching systems still running these end-of-support Office versions or isolate them.
• Block or sandbox untrusted Office documents and disable macros where not required.
• Enforce attachment filtering and user awareness for unsolicited documents.

Detection

• Monitor for Office processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Alert on unexpected outbound network connections originating from WINWORD.EXE or EXCEL.EXE.
• Review endpoint logs for document opens followed by suspicious file writes or process creation.
• Hunt for known exploit document indicators and correlate with KEV-listed activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.