The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Use Microsoft vendor hub and .Net Framework product page to widen CVE-2015-1671 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2024-29059, CVE-2024-0057 and CVE-2025-21176 for nearby disclosures in the same product family. Additional editorial context is available in Cybersecurity Weekly Roundup: April 22, 2026 — Critical Zero-Days and Framework Failures.