Cyber Resilience

CVE-2017-0199

Microsoft Office 2007 … 2016

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linked
Published
12 April 2017
Modified
22 April 2026
KEV Added
03 November 2021
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.99 100.0th percentile
Risk Priority 83 floored blend · peak EPSS

Summary

CVE-2017-0199 is a high-severity an unspecified weakness vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2017-0199 is a remote code execution vulnerability affecting Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1. The flaw resides in the handling of crafted documents through the Windows API and is tracked as the Microsoft Office/WordPad Remote Code Execution Vulnerability.

Remote attackers can exploit the issue by supplying a malicious document that, when opened by a user, results in arbitrary code execution on the target system. The vulnerability carries a CVSS 3.1 base score of 7.8 with an attack vector requiring local access and user interaction but granting high impact to confidentiality, integrity, and availability.

Public references include technical analyses of malicious RTF samples and an ICS-CERT advisory that address detection and response considerations for affected environments.

EU & UK References

Vulnerability Data

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka…

more

"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

CWE(s)
KEV Date Added
03 November 2021

Related Threats

CVEs Like This One

CVE-2017-0101Same product: Microsoft Windows 7both on KEV
CVE-2014-1812Same product: Microsoft Windows 7both on KEV
CVE-2016-0040Same product: Microsoft Windows 7both on KEV
CVE-2014-0322Same product: Microsoft Windows 7both on KEV
CVE-2016-0099Same product: Microsoft Windows 7both on KEV
CVE-2015-1701Same product: Microsoft Windows 7both on KEV
CVE-2014-6352Same product: Microsoft Windows 7both on KEV
CVE-2014-4114Same product: Microsoft Windows 7both on KEV
CVE-2016-0167Same product: Microsoft Windows 7both on KEV
CVE-2015-0016Same product: Microsoft Windows 7both on KEV

Affected Assets

microsoft
office
2007, 2010, 2013, 2016
microsoft
windows 7
all versions
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions
microsoft
windows vista
all versions
philips
intellispace portal
7.0, 8.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References