CVE-2015-6131

🗓️ 09 Dec 2015 11:00:00Reported by microsoftType

cve

cve🔗 web.nvd.nist.gov👁 95 Views🌐 WEB

"CVE-2015-6131 - Media Center Library Parsing RCE Vulnerability

Reporter	Title	Published	Views	Family All 14
0day.today	Microsoft Windows Media Center Library Parsing RCE Vulnerability aka "self-executing" MC	9 Dec 201500:00	–	zdt
BDU FSTEC	Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code	19 Jan 201600:00	–	bdu_fstec
CNVD	Microsoft Windows Media Center Library Analysis RCE Vulnerability	9 Dec 201500:00	–	cnvd
Check Point Advisories	Microsoft Windows Media Center Remote Code Execution (MS15-134: CVE-2015-6131)	8 Dec 201500:00	–	checkpoint_advisories
Cvelist	CVE-2015-6131	9 Dec 201511:00	–	cvelist
Exploit DB	Microsoft Windows Media Center Library - Parsing Remote Code Execution aka 'self-executing' MCL File	9 Dec 201500:00	–	exploitdb
exploitpack	Microsoft Windows Media Center Library - Parsing Remote Code Execution aka self-executing MCL File	9 Dec 201500:00	–	exploitpack
Kaspersky	KLA10714 Multiple vulnerabilities in Microsoft Windows	8 Dec 201500:00	–	kaspersky
Kaspersky	KLA10715Multiple vulnerabilities in Microsoft Windows Media Center	8 Dec 201500:00	–	kaspersky
NVD	CVE-2015-6131	9 Dec 201511:59	–	nvd

NVD

Node

microsoft windows_7Match-sp1

OR

microsoft windows_8Match-

OR

microsoft windows_8.1Match-

OR

microsoft windows_vistaMatch-sp2

Source	Link
securitytracker	www.securitytracker.com/id/1034335
docs	www.docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-134
exploit-db	www.exploit-db.com/exploits/38911/

Parameter	Position	Path	Description	CWE
url	nested	self-exec1.mcl	MCL file referencing itself to load HTML in local machine zone enabling code execution.	CWE-20
url	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
RecordsetURL	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
rs.Open	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
ActiveXObject	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
RecordsetURL	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
recordsetfile.txt	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
WScript.Shell	nested	self-exec2.mcl	MCL with ActiveX/ADO usage to fetch and execute remote payload.	CWE-20
defdir	nested	Create-recordsetfile.hta	HTA payload created to retrieve data and execute commands via VBScript/ActiveX.	CWE-20
recordsetdata.txt	nested	Create-recordsetfile.hta	HTA payload created to retrieve data and execute commands via VBScript/ActiveX.	CWE-20

17 Jun 2026 00:30Current

7.5High risk

Vulners AI Score7.5

CVSS 29.3

EPSS0.30538

cve 2015 6131 media center windows vista sp2 7 sp1 8 8.1 remote attackers arbitrary code .mcl file rce vulnerability