CVE-2017-0199 KEV EXPLOIT
7.8
HIGH · CVSS 3.1 · EPSS 99.5% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2022-05-03.
Description
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Scoring
| CVSS | 7.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 99.5% — more likely to be exploited than 100% of all CVEs |
| On CISA KEV | yes — remediate by 2022-05-03 |
| Public exploit | yes |
| Published | 2017-04-12 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Microsoft Office and WordPad Remote Code Execution Vulnerability |
|---|---|
| Added | 2021-11-03 |
| Due | 2022-05-03 |
| Vendor / product | Microsoft / Office and WordPad |
| Ransomware use | known |
Affected (6)
| Vendor | Product |
|---|---|
| microsoft | office |
| microsoft | windows 7 |
| microsoft | windows server 2008 |
| microsoft | windows server 2012 |
| microsoft | windows vista |
| philips | intellispace portal |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft Excel - OLE Arbitrary Code Execution | 2017-09-30 |
| exploit-db | Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit) | 2017-04-25 |
| exploit-db | Microsoft Word - '.RTF' Remote Code Execution | 2017-04-18 |
References
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
- http://www.securityfocus.com/bid/97498
- http://www.securitytracker.com/id/1038224
- https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
- https://www.exploit-db.com/exploits/41894/
- https://www.exploit-db.com/exploits/41934/
- https://www.exploit-db.com/exploits/42995/
- https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
- https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
- http://www.securityfocus.com/bid/97498
- http://www.securitytracker.com/id/1038224
- https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
- https://www.exploit-db.com/exploits/41894/
- https://www.exploit-db.com/exploits/41934/
- https://www.exploit-db.com/exploits/42995/
→ the Explorer · watch your stack · NVD