CVE-2015-1671

Critical

91.3

RPS

Description

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

Source: NVD

CVSS: 7.8; High · v3.1
EPSS: 48.98%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since May 2022
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: Not mapped
Published: 13 May 2015; Last modified 22 Apr 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2015-1671

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2015-1671

Description

Signals

Get this score from the API