CVE-2015-2456 : Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2455.

Published 2015-08-15 00:59:17

Updated 2025-04-12 10:46:41

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2015-2456

Microsoft » Office » Version: 2007 Update SP3
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » .net Framework » Version: 3.5
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 8 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2012
When used together with: Microsoft » Windows Server 2012 » Version: R2
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
Microsoft » .net Framework » Version: 4.0
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 3.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5
cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5.1
cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5.2
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.6
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » Windows Vista » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For Itanium
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Matching versions
Microsoft » Windows 7 » Version: N/A
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Silverlight
Versions up to, including, (<=) 5.1.40416.0
cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 8 » Version: N/A
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2010
cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2013 Update SP1
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2010 Attendee Edition
cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: R2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Rt » Version: N/A
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Lync Basic » Version: 2013 Update SP1
cpe:2.3:a:microsoft:lync_basic:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows 8.1 » Version: N/A
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Rt 8.1 » Version: N/A
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Live Meeting » Version: 2007
cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: N/A
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2015-2456

Top countries where our scanners detected CVE-2015-2456

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-2456 20,988

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-2456!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-2456

EPSS FAQ

46.45%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-2456

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2015-2456

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-2456

http://www.securityfocus.com/bid/76241

Microsoft Windows TrueType Fonts CVE-2015-2456 Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/37918/

Microsoft Windows - 'win32k.sys' TTF Font Processing win32k!scl_ApplyTranslation Pool-Based Buffer Overflow
Exploit;Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1033238

Microsoft Graphics Component Bugs Let Remote Users Execute Arbitrary Code and Remote Authenticated Users Bypass Security Features and Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080

Microsoft Security Bulletin MS15-080 - Critical | Microsoft Docs
Patch;Vendor Advisory

CVEs referencing this url