Is CVE-2015-2545 (Microsoft Office Malformed EPS File) being exploited in the wild?

Yes. CISA added CVE-2015-2545 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

The practical answer is yes, and the key operational fact is that CISA only adds a vulnerability to the KEV catalogue when there is reliable evidence of active exploitation. For defenders, that moves the question from “should we patch soon?” to “are we exposed right now, and have we already been touched?”

Because the issue is a Microsoft Office code execution flaw triggered through a crafted EPS image, the exposure is not just the vulnerable application version, but every workflow that can receive and open attacker-supplied Office content. That includes mail, document exchange, shared drives, and any business process where users routinely open files from outside the trust boundary.

For authoritative status checks, start with the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database. The first tells you whether CISA considers exploitation confirmed, while the second gives the canonical CVE record to anchor internal tracking and change control.

Why this vulnerability deserves urgent handling

The immediate security issue is remote code execution through a file format that can arrive as ordinary business content. That makes the weakness attractive to attackers because it fits into phishing, document delivery, and other initial-access paths without requiring an obvious exploit chain on the victim side.

Even when ransomware is not explicitly tied to a CVE, exploited Office flaws are high-value because they can provide a first foothold for credential theft, malware staging, or follow-on lateral movement. In practice, the user opening the file is often the final step in a broader intrusion path, not the end of the event.

CVE Program records define the vulnerability identity, but the operational significance comes from how quickly attackers can turn a document-based flaw into execution on an endpoint. That is why exploitability, not just severity labels, should drive triage priority.

What to check and do if patching is delayed

First confirm whether Microsoft Office is present in the estate and whether the affected exposure path is reachable by ordinary users. Then look at compensating controls that reduce delivery and execution risk, such as hardening mail filtering, blocking untrusted attachments, limiting preview and embedded content handling, and tightening endpoint execution controls.

If patching must wait, treat the delay as a temporary exception that needs explicit ownership, time bounds, and monitoring. The important question is whether the system can still ingest and open EPS-bearing content from untrusted sources, because that is the condition that keeps exploitation viable.

Use FIRST EPSS only as a prioritisation input, not as a substitute for KEV status. For a KEV-listed issue, confirmed exploitation outweighs probabilistic scoring when you are deciding what gets fixed first.

Risk and Threat Considerations

This CVE is high risk because it combines a widely deployed productivity product, a file-based delivery path, and remote code execution. That combination gives attackers a straightforward way to turn everyday document handling into initial access, which is why KEV listing matters operationally.

Failure mechanism: A crafted EPS image is processed by Microsoft Office in a way that allows arbitrary code execution, so a single document open can become code execution on the endpoint.

Impact: The likely consequences are endpoint compromise, payload delivery, credential theft, and escalation into broader intrusion activity if the system is not isolated or rapidly contained.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, OWASP ASVS, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification and remediation of exposed systems.
Recommendation — Prioritise and remediate the Office flaw through continuous vulnerability management and exception tracking.
OWASP ASVS	V13 — Configuration	Untrusted document handling and application hardening shape whether the exploit path remains reachable.
Recommendation — Harden Office and document-processing settings to reduce exposure to crafted file content.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Known exploited vulnerabilities demand timely remediation and verified deployment across affected assets.
	SI-4 — System Monitoring	Active exploitation warrants monitoring for malicious document delivery and endpoint compromise indicators.
Recommendation — Remediate the flaw promptly and verify the fix reached all in-scope hosts. Increase monitoring for exploit delivery, execution, and post-compromise activity.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded	The issue depends on knowing which systems still run the exposed Office attack surface.
Recommendation — Identify affected assets and track the exposed attack surface until remediation is complete.

Practitioner Guidance

What to prioritise: Treat KEV-listed Office exploitation as an emergency remediation item, not routine vulnerability backlog work. If the vulnerable software is exposed to external document flow, prioritise those systems before less reachable installations.

What to verify: Confirm whether users can receive and open EPS content, whether patching or mitigation has actually reached the estate, and whether endpoint detection and mail controls would have seen a malicious document delivery attempt.

Practitioner takeaway: Once a CVE is in KEV, the question is no longer theoretical exposure, it is whether the organisation can prove it is protected, patched, or actively monitoring for compromise.