ZeroDay Findings
Sign inSign up

Findings

CVE-2015-1641

Microsoft Office Memory Corruption Vulnerability

Published Apr 14, 2015 · updated Jun 16, 2026 · microsoft office

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Apr 14, 2015 · Catalog

    Detected

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe microsoft/office2010
  • cpe microsoft/office compatibility packversion unspecified
  • cpe microsoft/office web apps2010
  • cpe microsoft/office web apps2013
  • cpe microsoft/outlook2011
  • cpe microsoft/sharepoint server2010
  • cpe microsoft/sharepoint server2013
  • cpe microsoft/word2007
  • vendor Microsoft Officeversion unspecified

Sources

  • CISA KEVCVE-2015-1641

    Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.

    cisa.gov
  • CVE.orgCVE-2015-1641

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-1641

    30-day exploitation probability 97.2%

    first.org
  • NIST NVDCVE-2015-1641

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers

    nvd.nist.gov

References