Actively exploited · Published Jul 11, 2017 · Assigned by microsoft
CVE-2017-8570
High 7.8 Exploited
In plain English
A high-severity security flaw in Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016. from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on February 25, 2022). The chance it is exploited in the next 30 days is estimated at 89.9% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Aug 25, 2022.
Official description
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corporation | Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016. | Microsoft Office |
References
- 99445 vdb-entry, x_refsource_BID
- https://github.com/rxwx/CVE-2017-8570 x_refsource_MISC
- https://github.com/tezukanice/Office8570 x_refsource_MISC
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8570 x_refsource_CONFIRM
- https://github.com/ParsingTeam/ppsx-file-generator x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8570 government-resource