{"id":"CVE-2015-1641","published":"2015-04-14T20:59:05Z","modified":"2026-06-17T00:22:45Z","title":"Microsoft Office Memory Corruption Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka \"Microsoft Office Memory Corruption Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in Microsoft Office affects several products, including Word 2007 SP3, Office 2010 SP2, Word 2013 SP1, Word for Mac 2011, the Office Compatibility Pack SP3, and Word Automation Services and Office Web Apps Server on SharePoint Server 2010 and 2013. An attacker who supplies a crafted RTF document can execute arbitrary code, but only if a user is induced to open or interact with that document.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:02Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.97246,"percentile":0.99895,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1641","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-04-14","exploitedFirstSeen":"2015-04-14","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-04-14"},{"url":"https://www.sekoia.fr/blog/ms-office-exploit-analysis-cve-2015-1641/","date":"2016-04-12"},{"url":"https://unit42.paloaltonetworks.com/unit42-new-sofacy-attacks-against-us-government-agency/","date":"2016-06-14"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=09308982-77bd-41e0-8269-f2cc9ce3266e&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments","date":"2016-07-25"},{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf","date":"2016-08-08"},{"url":"https://unit42.paloaltonetworks.com/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/","date":"2017-01-05"},{"url":"https://us-cert.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf","date":"2017-02-10"},{"url":"https://www.forcepoint.com/de/blog/x-labs/trojanized-adobe-installer-used-install-dragonok-s-new-custom-backdoor","date":"2017-03-27"},{"url":"https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target","date":"2017-06-01"}],"evidenceTotal":25,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-399","name":null}],"references":[{"url":"http://www.securityfocus.com/bid/73995","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032104","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/73995","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032104","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1641","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: memory corruption yields code execution in client","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code","start":258,"end":306}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens malicious document triggers exploit","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"via a crafted RTF document","start":307,"end":333}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-aae333eb08b39b689148","title":"It’s Parliamentary: KeyBoy and the Targeting of the Tibetan Community","publisher":"citizenlab.ca","url":"https://citizenlab.ca/research/parliament-keyboy/","date":null,"mentions":[{"quote":"The second attempt used a newer, but also patched, .rtf vulnerability (CVE-2015-1641).","start":6159,"end":6245},{"quote":"The .rtf document attached to the malicious email was designed to exploit a more recent vulnerability: CVE-2015-1641.","start":10449,"end":10566},{"quote":"The two .rtf vulnerabilities targeted in these exploitation attempts, CVE-2012-0158 and CVE-2015-1641, are among a set of four .rtf vulnerabilities discussed in recent reporting from researchers at Arbor Networks.","start":11825,"end":12038},{"quote":"The researchers describe the presumed existence of an exploit document ‘builder’ designed to selectively weaponize .rtf files using four older, patched, vulnerabilities: CVE-2012-0158, CVE-2012-1856, CVE-2015-1641, and CVE-2015-1770.","start":12042,"end":12275}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-1641","start":26659,"end":26672},{"quote":" The STRONTIUM exploits that target CVE-2015-1641 and CVE-2015-","start":40656,"end":40720},{"quote":"CVE-2015-1641 Word RTF Microsoft Word MS15-033","start":98558,"end":98604},{"quote":"46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331, 54\r\nCVE-2014-0322, 54\r\nCVE-2014-0497, 53\r\nCVE-2014-0515, 53\r\nCVE-2014-6332, 43, 44, 50\r\nCVE-2014-8439, 46, 53\r\nCVE-2015-0097, 57\r\nCVE-2015-0310, 47\r\nCVE-2015-0311, 46, 47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47, 53\r\nCVE-2015-1641, 16,","start":238225,"end":238534}]},{"id":"SRC-5d409288624ad2cb61d6","title":"Tech brief untangling the patchwork cyberespionage group","publisher":"documents.trendmicro.com","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf","date":null,"mentions":[{"quote":"These are RTF files exploiting CVE-2015-\r\n1641, a memory corruption vulnerability in Microsoft Office patched last April 2015.","start":15192,"end":15318},{"quote":"Figure 11: Screenshots of RTF files that exploit CVE-2015-1641 and deliver the Badnews backdoor","start":15609,"end":15704}]},{"id":"SRC-37b543b4cde4966b286b","title":"MONSOON – ANALYSIS OF AN APT CAMPAIGN","publisher":"forcepoint.com","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf","date":null,"mentions":[{"quote":"vulnerability (CVE-2015-1641 [5]) and that it had filenames","start":18209,"end":18268},{"quote":"Microsoft BizTalk Server Windows Common Controls (MSCOMCTL.OCX)\r\nBug Lets Remote Users Execute Arbitrary Code\r\nCVE-2014-6352 Microsoft Windows CVE-2014-6352 OLE Package Manager Remote Code\r\nExecution Vulnerability\r\nCVE-2015-1641 Microsoft Office Memory Errors Let Remote Users Execute Arbitrary","start":27175,"end":27469},{"quote":"CVE-2015-1641 has been observed as being exploited to drop BADNEWS.","start":28016,"end":28083},{"quote":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1641.","start":84634,"end":84695}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-1771","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1771","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2015-10-27","earliestUrl":"https://github.com/Cyberclues/rtf_exploit_extractor","repos":[{"name":"Cyberclues/rtf_exploit_extractor","url":"https://github.com/Cyberclues/rtf_exploit_extractor","stars":23,"created":"2015-10-27"}]},"first":{"date":"2015-10-27","source":"PoC-in-GitHub","url":"https://github.com/Cyberclues/rtf_exploit_extractor"},"provenance":"source"},"detections":{"cveRules":[{"title":"Exploit for CVE-2015-1641","id":"7993792c-5ce2-4475-a3db-a3a5539827ef","level":"critical","status":"stable","path":"rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml","techniques":["T1036.005"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"source"},{"stage":"related","techniques":["T1189","T1055"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-04-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1641","provenance":"source"},{"date":"2015-04-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-10-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Cyberclues/rtf_exploit_extractor","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1771","provenance":"source"}],"speed":{"daysToPublicExploit":196,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2395},"priority":{"score":87.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4216 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-787"}}