CVE-2015-2545

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 contain a vulnerability that permits remote attackers to execute arbitrary code through a malformed EPS image file. The flaw is tracked as CVE-2015-2545 and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low attack complexity, no required privileges, and required user interaction.

An attacker can deliver the crafted EPS image via email, a malicious document, or another file-sharing mechanism; once the recipient opens the file in an affected Office application, the vulnerability allows arbitrary code execution with the privileges of the current user. Public exploit material demonstrates successful bypass of EMET protections in addition to code execution.

Microsoft security bulletin MS15-099 addresses the issue and supplies patches for the listed Office versions. The bulletin constitutes the primary source of official remediation guidance.

Exploits targeting this vulnerability have been publicly discussed, including techniques that evade existing exploit-mitigation tools such as EMET.