EXPOSURES › CVE-2015-1671
CVE-2015-1671
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in Windows TrueType font handling was actively exploited in the wild, allowing attackers to execute arbitrary code on unpatched systems.
This vulnerability allowed remote attackers to execute code on Windows systems by exploiting improper handling of TrueType fonts. DIB organizations must ensure all Windows systems are patched against this known, actively exploited flaw to prevent compromise and maintain compliance with CMMC/NIST 800-171 requirements for patch management and vulnerability mitigation.
Shame score — A known, actively exploited vulnerability in a foundational OS component that was left unpatched for years, demonstrating severe negligence and avoidable risk.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |