How severe is CVE-2015-1759?

CVE-2015-1759 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2015-1759 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 16% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-1759?

CVE-2015-1759 affects Microsoft Office Compatibility Pack. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2015-1759?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2015-1759 published?

CVE-2015-1759 was published on 2015-06-10 and last updated on 2026-06-17.

CVE-2015-1759

CVE-2015-1759 is a critical-severity vulnerability in Microsoft Office Compatibility Pack with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 16% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-19.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 16% (97th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-19
Affected product: Microsoft Office Compatibility Pack
Published: 2015-06-10
Last modified: 2026-06-17

Description

Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Frequently asked questions

What is CVE-2015-1759?: Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
How severe is CVE-2015-1759?: CVE-2015-1759 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2015-1759 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 16% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-1759?: CVE-2015-1759 affects Microsoft Office Compatibility Pack. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2015-1759?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2015-1759 published?: CVE-2015-1759 was published on 2015-06-10 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*

More vulnerabilities in Microsoft Office Compatibility Pack

CVE-2015-6177 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary…
CVE-2015-6172 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office…
CVE-2015-6124 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack…
CVE-2015-6122 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow…
CVE-2015-6040 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and…
CVE-2015-6092 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office…

All CVEs affecting Microsoft Office Compatibility Pack →

Other CWE-19 vulnerabilities

CVE-2015-2373 — Critical (CVSS 10.0): The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows…
CVE-2014-8822 — Critical (CVSS 10.0): IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a…
CVE-2014-8817 — Critical (CVSS 10.0): coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are…
CVE-2014-4488 — Critical (CVSS 10.0): IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate…
CVE-2014-7247 — Critical (CVSS 10.0): Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010;…
CVE-1999-0226 — Critical (CVSS 10.0): Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.

Browse all CWE-19 vulnerabilities →