Microsoft Office RTF Memory Corruption Vulnerability (CVE-2015-1641, MS15-033) Technical Analysis and Mitigation Guide

# Query Windows Update Agent for MS15-033 related KBs
Write-Host 'Searching for missing MS15-033 security updates...' -ForegroundColor Cyan
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Criteria = "IsInstalled=0 and Type='Software' and (Title like '%KB2956163%' or Title like '%KB2956113%')"
$Result = $Searcher.Search($Criteria)

if ($Result.Updates.Count -gt 0) {
    Write-Host 'Action Required: Critical security updates are missing.' -ForegroundColor Red
    foreach ($Update in $Result.Updates) {
        Write-Host "- Missing: $($Update.Title)" -ForegroundColor Yellow
    }
} else {
    Write-Host 'No missing MS15-033 updates detected.' -ForegroundColor Green
}

Windows Registry Editor Version 5.00

; Block Word 2013 from opening RTF files as a temporary workaround
[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Security\FileValidation]
"EnableFileValidation"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Security\FileBlock]
"RtfFiles"=dword:00000002
"OpenInOpenSaveBehavior"=dword:00000000

# Audit WINWORD.EXE version to detect vulnerability status
$paths = @(
    "${env:ProgramFiles}\Microsoft Office\Office15\WINWORD.EXE",
    "${env:ProgramFiles(x86)}\Microsoft Office\Office15\WINWORD.EXE"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        $version = (Get-Item $path).VersionInfo.ProductVersion
        Write-Host "Found Word 2013 at: $path (Version: $version)" -ForegroundColor Cyan
        if ([System.Version]$version -lt [System.Version]'15.0.4711.1000') {
            Write-Host '[ALERT] Vulnerable version of Word detected! Apply MS15-033 immediately.' -ForegroundColor Red
        } else {
            Write-Host '[PASS] Word version is patched and secure.' -ForegroundColor Green
        }
    }
}