Vulnerability in Microsoft Office
CVE-2017-0199
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.995 (99.9th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 99.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.995 · newest: 0.995 · change: 0.000
Affected products
- Microsoft Office — versions 2007, 2010, 2013
- Microsoft Windows 7
- Microsoft Windows Server 2008 — versions r2
- Microsoft Windows Server 2012
- Microsoft Windows Vista
- Microsoft Corporation Office/wordpad — versions Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1
- Philips Intellispace Portal — versions 7.0, 8.0
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
- bhdresh/CVE-2017-0199
- haibara3839/CVE-2017-0199-master
- NotAwful/CVE-2017-0199-Fix
- SyFi/cve-2017-0199
- Exploit-install/CVE-2017-0199
- jacobsoo/RTF-Cleaner
- ahmed-tarek22752/security-vulnerability-in-Microsoft-Office.
- ahmed-tarek22752/RCE-CVE-2017-0199-detection-analysis
- Sunqiz/CVE-2017-0199-reprofuction
- herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199
References
- www.securityfocus.com/bid/97498 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/ (Exploit, Third Party Advisory)
- rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html (Exploit, Third Party Advisory)
- www.exploit-db.com/exploits/41894/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html (Exploit, Third Party Advisory, Broken Link)
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 (Patch, Vendor Advisory)
- ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 (US Government Resource, Third Party Advisory)
- www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/ (Exploit, Third Party Advisory)
- www.exploit-db.com/exploits/41934/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.exploit-db.com/exploits/42995/ (VDB Entry, Third Party Advisory, exploit)
Frequently asked questions
- What is CVE-2017-0199?
- CVE-2017-0199 is a high-severity vulnerability in Microsoft Office. CVSS score: 7.8/10. Published 2017-04-12.
- How severe is CVE-2017-0199?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2017-0199 known to be exploited?
- Yes. CVE-2017-0199 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 242 public proof-of-concept repositories are indexed.