CVE-2015-2545 KEVPublic exploit High · 7.8 EPSS 85.9%

Microsoft Office Malformed EPS File Vulnerability

Summary

The flaw is an improper input validation weakness in Microsoft Office, affecting Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1, when handling EPS image files. An attacker who supplies a crafted EPS image can execute arbitrary code, and exploitation requires that a user open or interact with the malicious file, with no prior authentication needed.

Official description · NVD

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."

Breakdown

74.5 / 100

Exploited: Yes, in CISA KEV
Reports: 2
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Trick a user into opening a fileT1204.002 · Malicious FileAI-written (claude-haiku-5-5)Medium confidence39 general detection rules
What they do
- Run code when a user opens a file or pageT1203 · Exploitation for Client ExecutionAI-written (claude-haiku-5-5)Medium confidence35 general detection rules

First seen exploited 1 day before it was disclosed.

First seen exploitedVulnCheck KEV evidence8 Sep 20151 day before
Disclosed9 Sep 2015day 0
Added to CISA KEVEU database agrees3 Mar 2022+6 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

ExecutionTA0002

Exploitation for Client Execution T1203 Medium

AI mapping from the description · primary impact

code executes via Office document parsing

execute arbitrary code via a crafted EPS image

From the official description (NVD) Original ↗

Malicious File T1204.002 Medium

AI mapping from the description · how it is exploited

user opens crafted EPS file

allows remote attackers to execute arbitrary code via a crafted EPS image

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 74 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-2545 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Exploitation for Client ExecutionT120335 general rules

Antivirus - Exploitation Framework Signaturecriticalstable
Droppers Exploiting CVE-2017-11882criticalstable
Audit CVE Eventcriticaltest
CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
Exploit for CVE-2017-8759criticaltest
Antivirus - APT Malware Signaturecriticalexperimental
Antivirus - Remote Access Tools Signaturecriticalexperimental

All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports

2 reportsservices.google.comMicrosoft

Reports are matched by finding the exact id CVE-2015-2545 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

services.google.comUndated

The Overlooked North Korean Actor

[PAGE 8] FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2018-4878 (Zero-day vulnerability) CVE-2017-0199 CVE-2015-2387 CVE-2015-2545…

Original (opens in a new tab) ↗

MicrosoftUndated

Platinum feature article Targeted attacks in South and Southeast Asia April 2016

CVE-2015-2545 is a use-after-free vulnerability in the embedded PostScript filter of Microsoft Office.

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Mar 2022. Federal due date 24 Mar 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Mar 2022. EUVD-2015-2638

Public exploitAdvisories link exploit code.

, 30 Oct 2026

85.9%Top 0.27%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.73%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 4071 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9973 19.9/20

Threat reports2 reports 6.1/10

Public exploit code1 NVD reference tagged Exploit 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total74.5

Record

Published: 9 Sep 2015
Modified: 17 Jun 2026
: CWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

The Overlooked North Korean Actor

Platinum feature article Targeted attacks in South and Southeast Asia April 2016

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 2

How attackers get in

What they do

techniques