{"id":"CVE-2015-1671","kind":"vulnerability","aliases":["CVE-2015-1671"],"related":[],"title":"Microsoft Windows: Microsoft Windows Remote Code Execution Vulnerability","description":"The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka \"TrueType Font Parsing Vulnerability.\"","summary":"Windows and several Microsoft components (.NET Framework, Office, Lync, Silverlight) mishandle TrueType fonts, allowing remote code execution. An attacker who gets a user or service to process a malicious font can run code on the machine.","severity":"critical","cvss":9.3,"epss":0.48832,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dot-net","exploited","infrastructure","lync","office","silverlight","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for this CVE per vendor instructions (CISA required action); exact KB numbers are unknown from the sources.","status":"open","published_at":"2015-05-13T10:59:03+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:39+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:15:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for this CVE per vendor instructions (CISA required action); exact KB numbers are unknown from the sources.","reach":"network","impact":"high","summary":"Windows and several Microsoft components (.NET Framework, Office, Lync, Silverlight) mishandle TrueType fonts, allowing remote code execution. An attacker who gets a user or service to process a malicious font can run code on the machine.","category":"infrastructure","who_cares":["windows","office","dot-net","lync","silverlight"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the affected Windows machine via crafted font.","analyst_note":"Find the exact Microsoft bulletin (MS15-010 per public record) and the affected Windows builds and patch KBs from the Microsoft Security Response Center advisory for CVE-2015-1671.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000472,"input_tokens":2833,"output_tokens":378,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1671':11A,14A '-2015':10A,13A '2007':82C,89C '2010':85C,92C,94C '2013':97C,101C '3.0':72C '3.5':74C '3.5.1':75C '4':76C '4.5':77C '4.5.1':78C '4.5.2':80C '5':104C,109C '5.1.40416.00':106C,113C 'aka':126C 'allow':39B,114C 'arbitrari':119C 'attack':44B,116C 'attende':95C 'basic':100C 'code':6A,41B,58B,120C 'compon':30B 'consol':90C 'craft':123C 'cve':9A,12A 'develop':110C 'directwrit':64C 'dot':18B 'dot-net':17B 'execut':7A,42B,118C 'exploit':20B 'font':38B,55B,125C,128C 'framework':32B,71C 'get':46B 'infrastructur':21B 'librari':65C 'live':87C 'lync':22B,34B,91C,93C,96C,99C 'machin':61B 'malici':54B 'meet':88C 'microsoft':1A,3A,15A,29B,69C 'mishandl':36B 'net':19B,31B,70C 'offic':23B,33B,81C 'pars':129C 'process':52B 'remot':5A,40B,115C 'run':57B 'runtim':111C 'servic':50B 'sever':28B 'silverlight':24B,35B,103C,108C 'sp1':98C,102C 'sp2':73C,86C 'sp3':83C 'truetyp':37B,124C,127C 'use':67C 'user':48B 'via':121C 'vulner':8A,130C 'window':2A,4A,25B,26B,63C 'windows':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-05-13T10:59:03+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-1671","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1671","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2015-1671","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1671","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-1671","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1671","severity":null,"published_at":"2015-05-13T10:59:03+00:00","modified_at":"2026-06-17T00:22:47+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}