CVE-2015-1770
Published: 10 June 2015
Summary
CVE-2015-1770 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Microsoft Office. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Deeper analysis
Microsoft Office 2013 SP1 and 2013 RT SP1 contain an uninitialized memory use vulnerability, identified as CVE-2015-1770 and assigned CWE-824, that permits remote code execution when a crafted Office document is processed. The flaw received a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, no required privileges, and required user interaction.
An attacker can deliver the malicious document through typical channels such as email or web downloads; successful exploitation grants arbitrary code execution on the target system, with high impact to confidentiality, integrity, and availability.
Microsoft security bulletin MS15-059 describes the issue and supplies the corresponding security updates for affected Office installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-1900
Vulnerability details
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor security update that eliminates the uninitialized-memory flaw before a crafted document can be exploited.
Malicious-code protection mechanisms can inspect or sandbox incoming Office documents and block or alert on the crafted content used for exploitation.
Integrity verification of software and documents can detect unauthorized modification or prevent loading of the specially crafted Office file.