Actively exploited · Published May 12, 2017 · Assigned by microsoft
CVE-2017-0262
High 7.8 Exploited
In plain English
A high-severity security flaw in Microsoft Office from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2022). The chance it is exploited in the next 30 days is estimated at 81.0% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Aug 10, 2022.
Official description
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corporation | Microsoft Office | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 |
References
- 98279 vdb-entry, x_refsource_BID
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0262 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0262 government-resource