60
CVE-2017-0261
Use-After-Free RCE in Microsoft Office 2010/2013/2016
CISA: Microsoft Office Use-After-Free Vulnerability
- CVSS 3.1
- 7.8 high
- EPSS
- 78%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2017-0261 is a use-after-free (CWE-416) remote code execution flaw in Microsoft Office 2010 SP2, 2013 SP1, and 2016, caused by improper handling of objects in memory. It is triggered by convincing a user to open a malicious document or email attachment, which corrupts memory and lets the attacker run arbitrary code with the victim's privileges (high impact on confidentiality, integrity, and availability). Any user of the affected Office editions is exposed, and because the attack requires user interaction via a crafted file, email-borne targeting is the realistic attack path. The flaw was patched in Microsoft's May 2017 Patch Tuesday releases after being exploited as a zero day, with public reporting linking active exploitation to Russian APT groups. It is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), and its EPSS score of 78.1% (100th percentile) reflects a very high likelihood of exploitation.
What to do: Apply Microsoft's May 2017 Patch Tuesday security updates to all installations of Office 2010 SP2, 2013 SP1, and 2016, following the vendor's instructions as required by the CISA KEV listing. Until patched, warn users against opening unsolicited or untrusted Office attachments and consider email filtering to block risky file types. Verify fleet compliance against the KEV required action (apply updates per vendor instructions) and prioritize endpoints of targeted or high-value users.
| Product | Affected |
|---|---|
| Microsoft Office 2010 | Service Pack 2 |
| Microsoft Office 2013 | Service Pack 1 |
| Microsoft Office 2016 | all versions prior to the May 2017 security updates |
Estimated exposure
masstens to hundreds of millions of users (Office's global install base across the affected editions) — Microsoft Office is deployed on effectively hundreds of millions of enterprise and consumer PCs, so the affected 2010/2013/2016 editions at the time of disclosure represented a mass-scale install base; precise counts are unknown.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft Office
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
In the news
6 storiesAPT Trends report Q2 2017
60
Microsoft Issues Patches for Another Four Zero
60
60
Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.
54
47