Actively exploited · Published May 12, 2017 · Assigned by microsoft
CVE-2017-0261
High 7.8 Exploited
In plain English
A high-severity use-after-free in Microsoft Office from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 78.1% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 24, 2022.
Official description
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corporation | Microsoft Office | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261 x_refsource_CONFIRM
- 98104 vdb-entry, x_refsource_BID
- 1038444 vdb-entry, x_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0261 government-resource