CVE-2015-6172: Microsoft Word and Office remote code execution via crafted Outlook email

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with complete impact and a very high EPSS percentile, though exploitation requires user interaction and no KEV listing or public exploit tag is present.

What it is

Microsoft Word and related Office components fail to properly validate input when processing a crafted email message handled by Outlook, allowing remote code execution. The flaw affects multiple Office versions and the Office Compatibility Pack, and because it is reachable through email it can be triggered without the victim opening a separate document.

Impact

An attacker can execute arbitrary code in the context of the logged-on user, giving full control of confidentiality, integrity and availability on the affected system.

Attack surface

The vector is network-reachable (AV:N) with no authentication required (Au:N), but exploitation requires medium complexity (AC:M) and some form of user interaction, since the crafted email must be processed by Outlook.

Exploitation

Not listed in CISA KEV and no reference tags indicate public exploit code, but EPSS is high at roughly 0.54 (98.9th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the Microsoft security update MS15-131 for all affected Word, Office and Office Compatibility Pack installations.
• Prioritize patching systems running Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016 and Word 2013 RT SP1.
• Reduce exposure by configuring Outlook to read email in plain text and disabling automatic preview/rendering of rich content where operationally feasible.
• Enforce least privilege so users do not operate with administrative rights, limiting the impact of successful code execution.

Detection

• Monitor for Word or Office processes spawning unexpected child processes such as cmd.exe, powershell.exe or scripting hosts.
• Review endpoint telemetry for Office applications writing executables or scripts to user-writable directories or temp paths.
• Hunt for anomalous Outlook-to-Word process chains and document rendering activity originating from email attachments or message bodies.
• Correlate email gateway logs for crafted messages targeting Office document handling with subsequent suspicious process creation on endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.