Vulnerability in Microsoft Excel
CVE-2015-0085
Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.172 (97.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.187 · newest: 0.172 · change: -0.015
Affected products
- Microsoft Excel — versions 2007, 2010
- Microsoft Excel Viewer
- Microsoft Office — versions 2010, 2013
- Microsoft Office Compatibility Pack
- Microsoft Office Web Apps Server — versions 2010, 2013
- Microsoft Powerpoint — versions 2007, 2010
- Microsoft Sharepoint Foundation — versions 2010, 2013
- Microsoft Sharepoint Server — versions 2007, 2010, 2013
- Microsoft Sharepoint Services — versions 3.0
- Microsoft Web Applications — versions 2010
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1031896 (vdb-entry)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022 (vendor-advisory)
Frequently asked questions
- What is CVE-2015-0085?
- CVE-2015-0085 is a vulnerability in Microsoft Excel. Published 2015-03-11.
- Is CVE-2015-0085 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.