Vulnerability Details : CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Vulnerability category: Execute code
Published 2015-04-14 20:59:01
Updated 2019-05-14 19:53:22
View at NVD,
CVE-2015-1635 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft HTTP.sys Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability which allows for remote code execution.
Added on 2022-02-10 Action due date 2022-08-10

Exploit prediction scoring system (EPSS) score for CVE-2015-1635

Probability of exploitation activity in the next 30 days: 97.55%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2015-1635

  • MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure
    This module dumps memory contents using a crafted Range header and affects only Windows 8.1, Server 2012, and Server 2012R2. Note that if the target is running in VMware Workstation, this module has a high likelihood of resulting in BSOD; however, VMware ESX and non-virtualized hosts seem stable. Using a larger target file should result in more memory being dumped, and SSL seems to produce more data as well. Authors: - Rich Whitcroft <[email protected]> - sinn3r <[email protected]> - Sunny Neo <[email protected]>
  • MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service
    This module will check if scanned hosts are vulnerable to CVE-2015-1635 (MS15-034), a vulnerability in the HTTP protocol stack (HTTP.sys) that could result in arbitrary code execution. This module will try to cause a denial-of-service. Authors: - Bill Finlayson - sinn3r <[email protected]>

CVSS scores for CVE-2015-1635

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
[email protected]

CWE ids for CVE-2015-1635

References for CVE-2015-1635

Products affected by CVE-2015-1635

This web site uses cookies for managing your session and website analytics (Google analytics) purposes as described in our privacy policy.
By using this web site you are agreeing to terms of use!