---
id: "CVE-2015-2424"
kind: "vulnerability"
aliases: ["CVE-2015-2424"]
title: "Microsoft PowerPoint: Microsoft PowerPoint Memory Corruption Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.40388
exploited: true
status: "open"
category: "package"
products: [{"name": "Microsoft PowerPoint", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "microsoft-office", "package", "powerpoint", "windows"]
not_affected_if: ["unknown"]
published_at: "2015-07-14T21:59:35+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2424", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-2424", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2424", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft PowerPoint: Microsoft PowerPoint Memory Corruption Vulnerability

Microsoft PowerPoint has a memory corruption flaw triggered by a crafted Office document. An attacker can run code on the victim's machine or crash PowerPoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft PowerPoint affected ? fixed ?

## Fix

Apply the Microsoft security update for PowerPoint per vendor instructions; the specific patch is not named in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2424
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-2424
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-2424

## From the sources

Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_