CVE-2017-0199
Published: 12 April 2017
Summary
CVE-2017-0199 is a high-severity an unspecified weakness vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2017-0199 is a remote code execution vulnerability affecting Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1. The flaw resides in the handling of crafted documents through the Windows API and is tracked as the Microsoft Office/WordPad Remote Code Execution Vulnerability.
Remote attackers can exploit the issue by supplying a malicious document that, when opened by a user, results in arbitrary code execution on the target system. The vulnerability carries a CVSS 3.1 base score of 7.8 with an attack vector requiring local access and user interaction but granting high impact to confidentiality, integrity, and availability.
Public references include technical analyses of malicious RTF samples and an ICS-CERT advisory that address detection and response considerations for affected environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-0566
Vulnerability details
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka…
more
"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks execution of malicious code delivered via crafted Office/RTF documents before or at the point of user-initiated opening.
Requires timely application of vendor patches that eliminate the Windows API handling flaw exploited by CVE-2017-0199.
Restricts Office and WordPad functionality (e.g., disabling unnecessary preview or external content handlers) to reduce the attack surface for document-based RCE.