CVE-2015-1681

Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 permiten a usuarios locales causar una denegación de servicio a través de un fichero .msc manipulado, también conocido como 'vulnerabilidad de la denegación de servicio del formato de ficheros de Microsoft Management Console.'

This vulnerability allows an attacker to cause a denial of service condition on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit open a malicious directory or device.
The specific flaw exists within the handling of Microsoft Management Console Snap-in Control files (.msc files). These files can contain encoded icons for display in the Windows shell or common file dialogs. By malforming this icon information, an attacker can overflow a statically allocated buffer on the stack and cause a denial of service condition. Because this is exposed through the common file dialogs, third-party applications or extensions may also be vulnerable to denial of service or execution of arbitrary code.