Vulnerability record · CVE-2015-6127 · published 9 December 2015
CVE-2015-6127: Windows Media Center arbitrary file read via crafted .mcl file
Microsoft · Windows 7
Windows Media Center on Windows Vista SP2, 7 SP1, 8, and 8.1 fails to properly handle crafted .mcl files, allowing an attacker to read arbitrary files on the target system. The flaw is an information disclosure issue (CWE-200) that can expose sensitive local file contents to a remote attacker.
Description
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
AV:N/AC:M/Au:N/C:P/I:N/A:N
Automated analysis
medium priorityThe flaw is a medium-severity information disclosure with a public exploit and high EPSS score, but it requires user interaction and affects only legacy Windows versions.
What it is
Windows Media Center on Windows Vista SP2, 7 SP1, 8, and 8.1 fails to properly handle crafted .mcl files, allowing an attacker to read arbitrary files on the target system. The flaw is an information disclosure issue (CWE-200) that can expose sensitive local file contents to a remote attacker.
Impact
An attacker can read arbitrary files accessible to the victim user, potentially exposing credentials, configuration data, or other sensitive local content. The CVSS 2.0 vector shows partial confidentiality impact only, with no integrity or availability effect.
Attack surface
The vulnerability is network-reachable (AV:N) but requires medium complexity (AC:M) and no authentication (Au:N). Exploitation depends on the victim opening or processing a crafted .mcl file, so some form of user interaction is needed despite the network vector.
Exploitation
CVE-2015-6127 is not listed in CISA KEV, but a public Exploit-DB entry (38912) exists and EPSS shows a 30-day probability of 0.46006 (98.75th percentile), indicating meaningful exploitation likelihood.
What to do
- Apply the Microsoft security update MS15-134 for Windows Media Center.
- Disable or remove Windows Media Center where it is not required.
- Block or restrict opening of untrusted .mcl files via email and web downloads.
- Educate users not to open .mcl files from unknown or untrusted sources.
- Consider application whitelisting to prevent unauthorized execution of Media Center components.
Detection
- Monitor for processes opening .mcl files, especially from email attachments or download directories.
- Audit Windows Media Center process access to sensitive files outside expected media paths.
- Review file access logs for unusual reads of system or user configuration files by Media Center.
- Search endpoint telemetry for .mcl file creation or execution events correlated with network downloads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/78516 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1034335 | Third Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-134 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/38912/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/78516 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1034335 | Third Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-134 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/38912/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2015-6127 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-6127), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
