What is the CVSS score of CVE-2015-2387?

CVE-2015-2387 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 31.2%.

Which versions of Microsoft are affected by CVE-2015-2387?

CVE-2015-2387 presents notable security risk, a out-of-bounds write vulnerability rated CVSS 7.8.. A patch is available.

Is CVE-2015-2387 being actively exploited?

Yes, CVE-2015-2387 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2015-2387?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

Microsoft CVE-2015-2387

HIGH

Out-of-bounds Write (CWE-787)

2015-07-14 secure@microsoft.com

Buffer Overflow Memory Corruption Microsoft Adobe

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

Patch released

Oct 22, 2025 - 00:15 nvd

Patch available

CVE Published

Jul 14, 2015 - 22:59 nvd

HIGH 7.8

DescriptionCVE.org

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability."

AnalysisAI

The Adobe Type Manager Font Driver (ATMFD.DLL) in Windows contains a memory corruption vulnerability that allows local privilege escalation, exploited by the Duqu 2.0 malware in targeted attacks against diplomatic entities.

Technical ContextAI

The CWE-787 out-of-bounds write in ATMFD.DLL (the kernel-mode Adobe Type Manager Font Driver) is triggered by processing crafted font data. Since ATMFD runs in kernel mode, exploitation grants SYSTEM-level privileges from any user context.

RemediationAI

Apply Microsoft security update MS15-077. Windows 10 moved ATMFD to user mode, significantly reducing the impact of font parsing vulnerabilities. Migrate to Windows 10+.