CVEvulnerability

CVE-2015-1671

7.8 HIGH Known exploited Published 2015-05-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Windows Remote Code Execution Vulnerability — Microsoft Windows

A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.

Added to KEV
2022-05-25
Remediation due
2022-06-15
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2015-1671
Status
Analyzed
Published
2015-05-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

Affected configurations

• microsoft .net framework 3.0 • microsoft .net framework 4.0 • microsoft .net framework 4.5 • microsoft .net framework 4.5.1 • microsoft .net framework 4.5.2 • microsoft .net framework 3.5.1 • microsoft .net framework 3.5 • microsoft live meeting 2007 • microsoft lync 2010 • microsoft lync 2013 • microsoft silverlight 5.0

References