CVE-2015-0091 — Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093

Back Back to CVE browser

HIGH

Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093

Published Mar 11, 2015

9.3

HIGH

CVSS 2.0

EPSS 19.84%

Description

Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.

Remediation

No remediation recorded yet.

Metrics

19.84% 0.19835

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.19835

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (19 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	19.84% (0.19835)	97.34th	v5 (v2026.06.15)
Jun 15, 2026	19.97% (0.19968)	97.09th	v5 (v2026.06.15)
Sep 14, 2025	23.73% (0.23727)	95.80th	v4 (v2025.03.14)
Apr 16, 2025	28.35% (0.28354)	96.17th	v4 (v2025.03.14)
Mar 30, 2025	23.73% (0.23727)	95.54th	v4 (v2025.03.14)
Mar 29, 2025	26.01% (0.26010)	94.00th	v4 (v2025.03.14)
Mar 17, 2025	23.73% (0.23727)	95.55th	v4 (v2025.03.14)
Dec 17, 2024	18.34% (0.18345)	96.19th	v3 (v2023.03.01)
Dec 5, 2024	36.26% (0.36258)	97.28th	v3 (v2023.03.01)
Oct 21, 2024	16.55% (0.16548)	96.12th	v3 (v2023.03.01)
Feb 16, 2024	12.40% (0.12400)	95.23th	v3 (v2023.03.01)
Dec 30, 2023	11.80% (0.11796)	94.79th	v3 (v2023.03.01)
Oct 4, 2023	12.78% (0.12777)	94.82th	v3 (v2023.03.01)
Apr 10, 2023	13.64% (0.13639)	94.72th	v3 (v2023.03.01)
Mar 7, 2023	13.38% (0.13378)	94.64th	v3 (v2023.03.01)
Mar 6, 2023	48.41% (0.48414)	98.63th	v2 (v2022.01.01)
Oct 10, 2022	48.41% (0.48414)	98.53th	v2 (v2022.01.01)
Jul 30, 2022	46.09% (0.46090)	98.30th	v2 (v2022.01.01)
Feb 4, 2022	44.24% (0.44237)	97.71th	v2 (v2022.01.01)

Weaknesses (1)

CWE-94

Code Injection

References (3)

http://www.securityfocus.com/bid/72905
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031889
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021
vendor-advisoryx_refsource_MSPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/72905		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031889		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021		vendor-advisoryx_refsource_MSPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Mar 11, 2015

Updated Aug 6, 2024

Reserved Nov 18, 2014

Link CVE-2015-0091

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-0091

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-0091