CVE-2015-1770

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-824

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/75016Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032523Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-059Patch, Vendor Advisory
http://www.securityfocus.com/bid/75016Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032523Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-059Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1770US Government Resource

Timeline

Published: Jun 10, 2015
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 28, 2022
NVD status: Analyzed

Related CVEs from 2015

CVE-2015-17716.8Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows CVE-2015-17727.3The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.CVE-2015-17734.3Cross-site scripting (XSS) vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitr CVE-2015-17746.8The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a deni CVE-2015-17755.5Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authentica CVE-2015-17766.2Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials fil CVE-2015-17775.9rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does CVE-2015-17789.8The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username CVE-2015-17798.6The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) we CVE-2015-17806.5oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center CVE-2015-17816.8Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows cont CVE-2015-17826.8The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified