CVE-2015-2546 KEVRansomwarePublic exploit High · 8.2 EPSS 10.1%

Microsoft Win32k Memory Corruption Vulnerability

Summary

A memory corruption flaw in the Win32k kernel-mode driver of Microsoft Windows (affecting Vista SP2 through Windows 10 and several Server and RT releases) lets a local user gain elevated privileges. An attacker needs local access to the system, and the exploit requires a crafted application to be run, which typically means the user has to launch it.

Official description · NVD

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.

Breakdown

81.7 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Trick a user into opening a fileT1204.002 · Malicious FileAI-written (claude-haiku-5-5)Medium confidence39 general detection rules
What they do
- Gain administrator or root rightsT1068 · Exploitation for Privilege EscalationAI-written (claude-haiku-5-5)Medium confidence31 general detection rules

First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 21 months after disclosure.

First seen exploitedVulnCheck KEV evidence8 Sep 20151 day before
Disclosed9 Sep 2015day 0
Public exploit codePoC-in-GitHub25 May 2017+21 mo
Added to CISA KEVknown ransomware use; EU database agrees15 Mar 2022+7 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

ExecutionTA0002

Malicious File T1204.002 Medium

AI mapping from the description · how it is exploited

User runs crafted application triggering the flaw

allows local users to gain privileges via a crafted application

From the official description (NVD) Original ↗

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068 Medium

AI mapping from the description · primary impact

Local privilege escalation to kernel level

allows local users to gain privileges via a crafted application

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Stage CapabilitiesT1608 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 70 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-2546 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Exploitation for Privilege EscalationT106831 general rules

Exploiting CVE-2019-1388criticalstable
Audit CVE Eventcriticaltest
HackTool - SysmonEOP Executioncriticaltest
InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
Possible Coin Miner CPU Priority Paramcriticaltest
Potential CVE-2021-41379 Exploitation Attemptcriticaltest
Potential SystemNightmare Exploitation Attemptcriticaltest
Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest

All 31 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportMicrosoft

Reports are matched by finding the exact id CVE-2015-2546 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Platinum feature article Targeted attacks in South and Southeast Asia April 2016

…vulnerability in the Microsoft Office PostScript interpreter (designated CVE-2015-2545) that enabled it to execute the attacker’s code and drop an attacker-generated malicious DLL onto the computer.5 The DLL exploited another previously unknown vulnerability (designated CVE-2015-2546) in the Windows kernel,…

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 15 Mar 2022. Federal due date 5 Apr 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 15 Mar 2022. EUVD-2015-2639

Public exploitAdvisories link exploit code.

, 30 Oct 2026

10.1%Top 4.4%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 95.6%).

3.1

8.2High · 8.2

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 4071 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9564 19.1/20

Threat reports1 report 3.9/10

Public exploit code1 PoC-in-GitHub repo 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.2 5.7/7

End-of-life productsupported or unknown 0.0

Total81.7

Record

Published: 9 Sep 2015
Modified: 14 Aug 2026
: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Privilege EscalationTA0004

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Platinum feature article Targeted attacks in South and Southeast Asia April 2016

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 2

How attackers get in

What they do

techniques