Microsoft Office 2007 IME vulnerabilities

2 CVEs affecting Microsoft Office 2007 IME, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2503, published 2015-11-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-4077: Microsoft IME Japanese Privilege Escalation Vulnerability, published 2014-11-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 54.6% chance of exploitation in the next 30 days. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote…
• CVE-2015-2503, published 2015-11-11. High severity, CVSS 9.3. EPSS: 16.5% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese)…