CVE
CVE-2015-6172
Microsoft · Office; Microsoft · Office compatibility pack; +1 more
- First Reported
- May 13, 2026
- Latest Reported
- May 13, 2026
CVE Enrichment
- CVSS
- 9.3 HIGH
- EPSS
- 53.82%
- EPSS Percentile
- 99.00%
- CISA KEV
- Not listed
Description
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability."
Technical Details
- CVSS Version
- 2.0
- CNA / NVD Source
- [email protected]
- Published
- 09-Dec-2015 18:59
- Last Modified
- 17-Jun-2026 07:30
- EPSS Date
- 2026-11-03
- CWE
- CWE-20
CVSS Vector
AV:N /
AC:M /
Au:N /
C:C /
I:C /
A:C
CNA Products / Version Status
- n/a · n/a
Source: CNA · [email protected]
Default status: unknown
n/a — affected
Affected Products / Versions
- microsoft / office
Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:office:2010:sp2:x64:*:*:*:*:* - microsoft / office
Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:office:2010:sp2:x86:*:*:*:*:* - microsoft / office_compatibility_pack
Source: NVD CPE · affected
Version / affected range: *
cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:* - microsoft / word
Source: NVD CPE · affected
Version / affected range: 2007
cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:* - microsoft / word
Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* - microsoft / word
Source: NVD CPE · affected
Version / affected range: 2013
cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* - microsoft / word
Source: NVD CPE · affected
Version / affected range: 2013
cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- That flaw, tracked as CVE-2015-6172 and named BadWinmail, was dubbed an “enterprise killer” at the time by the researcher, and the new flaw has the same attack vector and the same potential impact. Microsoft Patches CVE-2026-40361, a Critical Zero-Click Outlook Flaw
CVE (1)
People (1)
MITRE ATT&CK (1)
Vendors (1)
Products (3)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.