CVE-2015-2502

HIGH CISA KEV

Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.

Published: Aug 19, 2015 Modified: Apr 22, 2026

CWE-787 CWE-787

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: REQUIRED Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products (5)

Vendor	Product	Version
microsoft	internet_explorer	7
microsoft	internet_explorer	8
microsoft	internet_explorer	9
microsoft	internet_explorer	10
microsoft	internet_explorer	11

References (13)

http://twitter.com/Laughing_Mantis/statuses/633839231840841728 Exploit
http://twitter.com/Laughing_Mantis/statuses/633839771865886721 Press/Media Coverage
http://www.securityfocus.com/bid/76403 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033317 Broken Link, Third Party Advisory, VDB Entry
http://www.securityweek.com/microsoft-issues-emergency-patch-critical-ie-flaw-exploited-wild Press/Media Coverage
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-093 Patch, Vendor Advisory
http://twitter.com/Laughing_Mantis/statuses/633839231840841728 Exploit
http://twitter.com/Laughing_Mantis/statuses/633839771865886721 Press/Media Coverage
http://www.securityfocus.com/bid/76403 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033317 Broken Link, Third Party Advisory, VDB Entry
http://www.securityweek.com/microsoft-issues-emergency-patch-critical-ie-flaw-exploited-wild Press/Media Coverage
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-093 Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2502 US Government Resource

Risk Scores

CVSS Score 8.8 / 10

EPSS Score 51.13%

Top 1% most likely to be exploited

Threat Score 80.5 / 100

CISA Known Exploited

Date Added: 2022-04-13

Due Date: 2022-05-04

Required Action:

Apply updates per vendor instructions.

Data Sources

NVD CISA KEV EPSS