CVE-2015-6133 in the critical feed json
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library…
published 10y ago modified 4mo ago also EUVD-2015-6076
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 66.6%
- EPSS 66.6% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 2
- Metasploit and Exploit-DB
Summary
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Patch / fix
Is CVE-2015-6133 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/windows/fileformat/office_ole_multiple_dll_hijack)
- Published
Exploit prediction
66.58% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/fileformat/office_ole_multiple_dll_hijack Office OLE Multiple DLL Side Loading Vulnerabilities metasploit exploit, normal rank, 2015-12-08
- EDB-41706 Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit) local, 2015-12-08
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2015/ms15-132
vendor-advisory, patch
-
securitytracker.com
/id/1034338
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2015-6133
- NVD CVE-2015-6133
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.