What is CVE-2017-0030?

CVE-2017-0030 is a high-severity vulnerability in Microsoft Office, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2017-03-17.

How severe is CVE-2017-0030?

High severity. CVSS v3 base score is 7.8 out of 10.

Buffer overflow in Microsoft Office

CVE-2017-0030

Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.

Vulnerability class: Buffer Overflow

Published 2017-03-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.260 (97.9th percentile), scored 2026-10-06.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.260 · newest: 0.260 · change: 0.000

Affected products

Microsoft Office — versions 2010
Microsoft Office Compatibility Pack
Microsoft Office Web Apps — versions 2010
Microsoft Sharepoint Server — versions 2010
Microsoft Word — versions 2007, 2010
Microsoft Corporation Office — versions Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

www.securitytracker.com/id/1038010 (vdb-entry)
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0030 (Patch, Vendor Advisory)
www.securityfocus.com/bid/96051 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2017-0030?: CVE-2017-0030 is a high-severity vulnerability in Microsoft Office, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2017-03-17.
How severe is CVE-2017-0030?: High severity. CVSS v3 base score is 7.8 out of 10.