CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft Office and WordPadApplications & CMS
CVSS
7.8HighExploit odds (EPSS)99.5%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply updates per vendor instructions. CISA KEV
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 12 Apr 2017, 14:00 UTCPublishedCVE List
- 14 Apr 2017Exploit code publicMetasploit
- 3 Nov 2021Added to CISA KEVCISA KEV
Public exploit code and templates 4
- Exploit moduleMicrosoft Office Word Malicious Hta Execution 14 Apr 2017Metasploit
- Dos exploitMicrosoft Excel - OLE Arbitrary Code Execution 30 Sep 2017Exploit-DB
- Remote exploitMicrosoft Office Word - '.RTF' Malicious HTA Execution (Metasploit) 25 Apr 2017Exploit-DB
- Remote exploitMicrosoft Word - '.RTF' Remote Code Execution 18 Apr 2017Exploit-DB
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
Text from CVE List
Affected versions 1
- Office/WordPadaffected: Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1CVE List
References 10
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199Advisoryvia CVE List
- ics-cert.us-cert.gov/advisories/ICSMA-18-058-02Advisoryvia CVE List
- exploit-db.com/exploits/41894/Exploitvia CVE List
- exploit-db.com/exploits/41934/Exploitvia CVE List
- exploit-db.com/exploits/42995/Exploitvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2017-0199Referencevia CISA KEV
- blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/Referencevia CVE List
- fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.htmlReferencevia CVE List
- mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199Referencevia CVE List