CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability
Published Apr 12, 2017 · updated Jun 16, 2026 · microsoft office
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Timeline
Detection, updates, and resolution for this record.
Apr 12, 2017 · Catalog
Detected
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe microsoft/office2007
- cpe microsoft/office2010
- cpe microsoft/office2013
- cpe microsoft/office2016
- cpe microsoft/windows 7version unspecified
- cpe microsoft/windows server 2008version unspecified
- cpe microsoft/windows server 2008r2
- cpe microsoft/windows server 2012version unspecified
- cpe philips/intellispace portal7.0
- vendor Microsoft Office and WordPadversion unspecified
Sources
- CISA KEVCVE-2017-0199
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
cisa.gov - CVE.orgCVE-2017-0199
Official CVE identifier
cve.org - FIRST EPSSCVE-2017-0199
30-day exploitation probability 99.5%
first.org - Exploit Database41894
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database41934
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database42995
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/fileformat/office_word_hta
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2017-0199
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/
nvd.nist.gov