CVE-2015-1671 Microsoft Windows Remote Code Execution

Exploited in the wild High 7.8 Published 13 May 2015 Updated 21 Oct 2025

Remote attackers can execute arbitrary code via a crafted TrueType font in the Windows DirectWrite library used by various Microsoft applications.

Exploited in the wild: Since 25 May 2022
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2015-1671?

CVE-2015-1671 is a high-severity memory corruption vulnerability in Microsoft .Net Framework, published on 13 May 2015. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

Which versions are affected by CVE-2015-1671?

It affects 4 products.

Products include Microsoft .Net Framework, Microsoft Live Meeting, Microsoft Lync, Microsoft Silverlight.

How do I fix CVE-2015-1671?

No fix has been published for CVE-2015-1671 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Jun 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2015-1671 being exploited?

Yes. Attackers have exploited CVE-2015-1671 in the wild since at least 25 May 2022.

All Microsoft .Net Framework vulnerabilities

Sources

Also known as GHSA-gr4p-px5x-x8jm.