CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability

Vulnerability summary

CVE-2014-1761 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in Microsoft Word. It is known to be exploited: CISA lists it, first on 15-02-2022. EPSS estimates a 77.73% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-03-2014
   PublishedVulnerability first disclosed.
2. 15-02-2022
   Added to CISA KEVMicrosoft Word Memory Corruption Vulnerability
3. 15-08-2022
   CISA remediation dueApply updates per vendor instructions.
4. 22-10-2025
   Last modifiedVulnerability information updated.

Description

Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.