Vulnerability record · CVE-2015-2509 · published 9 September 2015
CVE-2015-2509: Windows Media Center MCL file remote code execution
Microsoft · Windows 7
Windows Media Center on Windows Vista SP2, 7 SP1, 8 and 8.1 fails to properly handle crafted Media Center link (.mcl) files, allowing arbitrary code execution. The flaw is an improper access control issue (CWE-284) that lets a malicious file run code in the context of the logged-on user. It matters because the affected platforms were widely deployed and a working exploit is publicly available.
Description
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityPublic exploit code and a very high EPSS score make exploitation likely, though the flaw requires user interaction and affects only legacy Windows versions.
What it is
Windows Media Center on Windows Vista SP2, 7 SP1, 8 and 8.1 fails to properly handle crafted Media Center link (.mcl) files, allowing arbitrary code execution. The flaw is an improper access control issue (CWE-284) that lets a malicious file run code in the context of the logged-on user. It matters because the affected platforms were widely deployed and a working exploit is publicly available.
Impact
An attacker who convinces a user to open a crafted .mcl file gains arbitrary code execution with the privileges of that user, enabling malware installation, data theft or further compromise of the host.
Attack surface
Reached remotely by delivering a malicious .mcl file (email attachment, download, or share) that the victim must open; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required but user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.71, 99th percentile) and public exploit code exists per ExploitDB and Rapid7 references, so exploitation is practical and likely.
What to do
- Apply Microsoft security bulletin MS15-100 for the affected Windows versions.
- Upgrade or retire unsupported Windows Vista, 7, 8 and 8.1 systems where patching is not possible.
- Block or quarantine .mcl file attachments and downloads at email and web gateways.
- Remove or restrict Windows Media Center where it is not required by business users.
- Educate users not to open unexpected .mcl files from untrusted sources.
Detection
- Monitor process creation for Media Center or related binaries spawning unusual child processes such as cmd.exe or powershell.exe.
- Alert on .mcl file writes or executions in user download, temp and email attachment directories.
- Search endpoint telemetry for .mcl file handles opened by Windows Media Center processes.
- Review proxy and email logs for .mcl attachments or downloads from external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.rapid7.com/db/modules/exploit/windows/fileformat/ms15_100_mcl_exe | Third Party Advisory |
| http://www.securityfocus.com/bid/76594 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1033499 | Third Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-100 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/38151/ | Third Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/38195/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.rapid7.com/db/modules/exploit/windows/fileformat/ms15_100_mcl_exe | Third Party Advisory |
| http://www.securityfocus.com/bid/76594 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1033499 | Third Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-100 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/38151/ | Third Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/38195/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2015-2509 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2509), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
