CVE-2017-0199 is a high-severity vulnerability that affects various Microsoft Office and Windows operating systems, including Windows Vista, Windows Server 2008, Windows 7, and Windows 8.1. Remote attackers can exploit this vulnerability to execute arbitrary code on affected systems through a crafted document. This issue poses a significant risk to users, as it allows attackers to potentially take control of an affected system, install programs, view, change, or delete data, and create new accounts with full user rights.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you should check if you're using any of the following software: Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, or Windows 8.1. The vulnerability can be exploited through a specially crafted document, so if you've opened or previewed any suspicious files in Microsoft Office or WordPad, you might be at risk. Keep in mind that this vulnerability allows remote attackers to execute arbitrary code and potentially take control of your system.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action to protect your system. First, update your Microsoft Office and Windows software to the latest versions, as Microsoft has released security updates to address this issue. Next, be cautious when opening or previewing documents from unknown sources, as the vulnerability can be exploited through a crafted document. Finally, consider using antivirus software to scan your system for potential threats.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, CVE-2017-0199 is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named Microsoft Office and WordPad Remote Code Execution Vulnerability, was added on November 3, 2021, with a due date of May 3, 2022. The required action is to apply updates according to vendor instructions to protect your system from potential exploitation.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as NVD-CWE-no info or Insufficient Information.

For more details

CVE-2017-0199, a high-severity vulnerability affecting Microsoft Office and WordPad, has been thoroughly analyzed, revealing its potential for remote code execution and the risks it poses to users. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• NVD - CVE-2017-0199

• Microsoft Word - '.RTF' Remote Code Execution

• Exploiting CVE-2017-0199: HTA Handler Vulnerability - MDSec

• Philips Intellispace Portal ISP Vulnerabilities | CISA

• CVE-2017-0199 - Security Update Guide - Microsoft - Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows