CVE-2015-2424

ENISA EUVD: EUVD-2015-2517 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 5, 2026 1 article

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

64.48%

probability

This CVE has a 64.48% probability of being exploited in the next 30 days.

0% Top 98.5th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Project Zero

Heap corruption in Forms.Image.1

Affected Products

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write

Google Project Zero

Discovered

June 30, 2015

Patched

July 14, 2015

Reported by

The Labs Team of iSIGHT Partners, Edward Fjellskål of Telenor CERT

Root Cause Analysis

???

Update2: Patch Tuesday July 2015

Qualys Jul 14, 2015

Signal Intelligence

Confidenceⓘ

95%

EPSS 64.48%

CVSS v3.1 8.8

Mentions 1

Last Seen Jul 14, 2015

CNA Information

Analyst Note

Auto-imported from Google Project Zero — confirmed zero-day by definition.

Triage Info

Decided atMar 05, 2026