CVE-2015-2464

CVE-2015-2464 is a critical TrueType font parsing vulnerability affecting numerous Microsoft products, including Windows operating systems, Office suites, Lync, Silverlight, and .NET Framework versions. A remote attacker can exploit this flaw by enticing a user to open a specially crafted TrueType font, leading to arbitrary code execution. With a CVSS score of 9.3, this vulnerability is highly severe due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild, an exploit (EDB-37914) demonstrating an out-of-bounds pool write in win32k.sys exists, and the vulnerability has a high EPSS score, indicating a significant likelihood of future exploitation. Despite its severity, there is minimal community discussion or media coverage surrounding this CVE.