CVE-2017-0199

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.”

Recent assessments:

hrbrmstr at May 12, 2020 7:44pm UTC reported:

This CVE made it into US-CERT’s “Top 10” bulletin released in May, 2020 – <https://www.us-cert.gov/ncas/alerts/aa20-133a&gt; / <https://web.archive.org/web/20200512161248/https://www.us-cert.gov/ncas/alerts/aa20-133a&gt;

• Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1

• Associated Malware: FINSPY, LATENTBOT, Dridex

• Mitigation: Update affected Microsoft products with the latest security patches

• More Detail: <https://nvd.nist.gov/vuln/detail/CVE-2017-0199&gt;

• IOCs: <https://www.us-cert.gov/ncas/analysis-reports/ar20-133g&gt;, <https://www.us-cert.gov/ncas/analysis-reports/ar20-133h&gt;, <https://www.us-cert.gov/ncas/analysis-reports/ar20-133p&gt;

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5