CVE-2015-0071VulnerabilityPublished 05/25/2022Updated 10/24/2026

CVE-2015-0071: Microsoft Internet Explorer ASLR Bypass Vulnerability

Affects Microsoft Internet ExplorerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/25/2022
KEV deadline: 06/15/2022
EPSS: 33.6% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2015-0071 (opens in a new tab)

Description

CVE-2015-0071 is a vulnerability in Microsoft Internet Explorer that allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted website. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

Microsoft Internet Explorer contains a security flaw identified as CVE-2015-0071 that enables remote attackers to bypass ASLR, a memory protection technique designed to prevent exploitation of memory corruption vulnerabilities. The bypass is achieved through a crafted website that triggers the vulnerability. This issue has been observed in active exploitation scenarios. However, no detailed version information or patch status is included in the provided data.

Impact

Successful exploitation of this vulnerability allows attackers to bypass ASLR, potentially increasing the likelihood of successful exploitation of other vulnerabilities by making memory addresses predictable. This can lead to arbitrary code execution or other malicious actions depending on additional vulnerabilities present. The vulnerability has been exploited in the wild, indicating active threat use.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor Microsoft security advisories for updates. Until a fix is confirmed, consider limiting exposure to untrusted websites and applying any available security updates to Internet Explorer and the underlying operating system.

Weaknesses

CWE-264Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:50:06 UTC

Weaknesses

References

Related threats