CVE-2015-1770: Microsoft Office uninitialized memory use allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with high impact and is confirmed exploited in CISA KEV, though it requires user interaction and affects only older Office 2013 SP1/RT SP1 builds.

What it is

Microsoft Office 2013 SP1 and 2013 RT SP1 mishandle uninitialized memory when parsing a crafted Office document, which can lead to arbitrary code execution. The flaw is remotely reachable and requires the victim to open a malicious file, making it a standard document-based attack vector against Office users.

Impact

An attacker who gets a crafted document opened can execute arbitrary code in the context of the affected Office process, giving full control of confidentiality, integrity and availability on the victim's system.

Attack surface

Reached over the network by delivering a malicious Office document that the user must open; no authentication is required, but user interaction is needed per the CVSS vector (AV:N/AC:L/PR:N/UI:R).

Exploitation

CVE-2015-1770 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), indicating exploitation in the wild, and EPSS gives a 30-day probability of 0.35105 (98.4th percentile); the record does not document ransomware use.

What to do

• Apply the Microsoft Office updates referenced in security bulletin MS15-059 (patch first).
• Upgrade or remove end-of-life Office 2013 SP1 and 2013 RT SP1 installations that can no longer be patched.
• Block or sandbox untrusted Office documents and enforce Protected View and Mark-of-the-Web handling.
• Disable or restrict macros and other active content in documents arriving from external sources.
• Educate users not to open unexpected Office attachments or downloads from untrusted senders.

Detection

• Monitor for Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office applications loading documents from email clients, browsers or temp download directories.
• Hunt for unusual file writes or network connections originating from Office processes after a document is opened.
• Review endpoint logs for crashes or memory-corruption indicators in Office 2013 builds tied to document opens.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.