CVE-2015-2545: Microsoft Office malformed EPS image remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, has a very high EPSS score, and yields remote code execution through a common user action.

What it is

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1 fail to properly handle a crafted EPS image, allowing memory corruption that leads to arbitrary code execution. The flaw is remotely triggerable through a document containing the malicious image, making it a classic client-side Office attack. It is listed in CISA's Known Exploited Vulnerabilities catalog, so it has been used in real attacks.

Impact

An attacker who gets the crafted file opened gains code execution in the context of the logged-on user, which can mean full control of the workstation and access to that user's data and credentials. Because Office documents are commonly exchanged, a single opened file can compromise a host.

Attack surface

Reached locally through the Office application when a user opens a document containing the malformed EPS image; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No authentication to a remote service is needed, only the victim opening the file.

Exploitation

CISA added it to KEV on 2022-03-03 with a 2022-03-24 remediation due date, and EPSS is 0.86053 (99.7th percentile), indicating high likelihood of exploitation. Reference tags include Exploit, and no ransomware campaign use is documented.

What to do

• Apply the Microsoft MS15-099 updates for the affected Office versions immediately.
• Where patching is delayed, block or strip EPS content in email attachments and document workflows.
• Disable or restrict EPS image handling in Office where feasible and enforce Protected View and macro/ActiveX restrictions.
• Segment and harden endpoints that run legacy Office 2007/2010/2013, since these versions are past mainstream support.
• Educate users not to open unexpected Office documents, especially from external senders.

Detection

• Hunt for Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Monitor for Office documents containing embedded EPS objects or unusual image streams, and alert on EPS parsing in document viewers.
• Review endpoint telemetry for memory corruption or crash patterns in Office when opening documents, and correlate with file download or email attachment events.
• Use the KEV due date to verify patch compliance for the affected Office builds across the estate.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.