CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability
Vulnerability summary
CVE-2017-0199 is a high (CVSS 9.3) vulnerability in Microsoft Office and WordPad. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 99.50% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 8 public exploits are recorded.
Timeline
- 12-04-2017PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVMicrosoft Office and WordPad Remote Code Execution Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.50%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
-0.44 pp
From 99.93% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-0199
Public exploits
8 foundExploit Reference (blog.nviso.be)
Maturity: unknown
Exploit Reference (rewtin.blogspot.nl)
Maturity: unknown
Exploit Reference (fireeye.com)
Maturity: unknown
Show all 8 exploits
Exploit Reference (mdsec.co.uk)
Maturity: unknown
Microsoft Excel - OLE Arbitrary Code Execution
Maturity: poc
Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)
Maturity: weaponized
Microsoft Word - '.RTF' Remote Code Execution
Maturity: poc
Microsoft Office Word Malicious Hta Execution
exploit/windows/fileformat/office_word_hta
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft5 products
- officeEOL2007:sp3 | 2010:sp2 | 2013:sp1 | 2016
- windows_7na
- windows_server_2008na | r2:sp1
- windows server 2012na
- windows_vistana
Microsoft corporation1 product
- office/wordpadOffice 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1
Philips1 product
- intellispace_portal7.0 | 8.0
3 vendors · 7 products
References
12 links- blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/X Refsource MISCExploitThird Party Advisory
- rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.htmlX Refsource MISCExploitThird Party Advisory
- www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.htmlX Refsource MISCBroken LinkExploitThird Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199X Refsource CONFIRMPatchVendor Advisory- ics-cert.us-cert.gov/advisories/ICSMA-18-058-02X Refsource MISCThird Party AdvisoryUS Government Resource
- www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/X Refsource MISCExploitThird Party Advisory
Show all 12 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199Government ResourceUS Government Resource