What is the CVSS score of CVE-2015-1641?

CVE-2015-1641 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.6%.

Which versions of Microsoft are affected by CVE-2015-1641?

CVE-2015-1641 presents notable security risk, a out-of-bounds write vulnerability rated CVSS 7.8.. A patch is available.

Is CVE-2015-1641 being actively exploited?

Yes, CVE-2015-1641 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2015-1641?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

Microsoft CVE-2015-1641

HIGH

Out-of-bounds Write (CWE-787)

2015-04-14 secure@microsoft.com

Buffer Overflow Microsoft RCE Memory Corruption

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

Patch released

Oct 22, 2025 - 00:15 nvd

Patch available

CVE Published

Apr 14, 2015 - 20:59 nvd

HIGH 7.8

DescriptionCVE.org

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

AnalysisAI

Microsoft Word 2007 through 2013 and SharePoint components contain a memory corruption vulnerability in RTF processing that allows remote code execution, heavily exploited by multiple APT groups throughout 2015-2017.

Technical ContextAI

The CWE-787 out-of-bounds write in Word's RTF parser is triggered by malformed RTF control words that cause heap corruption. The exploit achieves reliable code execution through precise heap manipulation, and works when RTF is rendered by Word, Outlook (which uses Word for rendering), and SharePoint.

RemediationAI

Apply Microsoft security update MS15-033. Disable RTF rendering in Outlook. Block RTF at email gateways. Enable Protected View for all external documents.