AKBuilder: A builder for exploit-laden Word documents

CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days.

Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching.

CVE-2014-1761 is a memory corruption vulnerability (CWE-119) in Microsoft Word that can be triggered by processing a maliciously crafted document, such as one delivered as an email attachment. Successful exploitation corrupts memory in a way that allows an attacker to execute arbitrary code on the victim's system with the privileges of the current user. Anyone running an affected Microsoft Word installation is exposed, which in practice spans a very large share of business and consumer desktops given Word's ubiquity. The flaw is confirmed as exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-02-15, and EPSS assigns it a 77.5% probability of exploitation in the next 30 days (100th percentile). No public proof-of-concept is known, but the KEV listing and high EPSS indicate real-world attacker activity, and Word document flaws of this kind have historically featured in targeted APT and spear-phishing campaigns.

Do: Apply Microsoft's security update for CVE-2014-1761 to every Word installation per vendor instructions, treating it as an actively exploited, high-priority patch. Until patched, be alert for unsolicited Word documents arriving by email, and consider file-blocking policies for documents from untrusted sources. Check that legacy Word editions within your estate are covered, since older builds that no longer receive routine updates are the most likely to remain exposed.

Microsoft Office contains a memory corruption flaw (CWE-399) in its handling of Rich Text Format (RTF) files, allowing a crafted RTF document to corrupt memory when the file is parsed. The flaw is triggered by opening a specially crafted RTF file — typically delivered as an email attachment — in an affected version of Microsoft Office. Successful exploitation yields remote code execution in the context of the current user, so attacker privilege is limited to the rights of the logged-in account. Per the CISA data, Microsoft Office is the affected product, with no specific version ranges provided; the flaw was fixed in Microsoft's April 2015 Patch Tuesday security updates (MS15-033), so risk is concentrated on systems that never applied those updates. Exploitation is confirmed in the wild — the CVE was added to the CISA KEV on 2021-11-03 (ransomware use unknown) — it carries a 96.8% EPSS probability of exploitation within 30 days (100th percentile), and related reporting links RTF exploit techniques of this era to targeted APT campaigns (e.g., the T9000 backdoor and DragonOK tooling).

Do: Apply Microsoft's April 2015 Office security updates (MS15-033) on all endpoints, per the CISA KEV required action, prioritizing hosts running older Office editions, and verify installation via installed-updates checks. As interim hardening, treat inbound RTF files with suspicion (block or sandbox RTF email attachments) and monitor for suspicious child processes spawned by Word (e.g., Winword.exe launching cmd.exe or PowerShell) to detect possible prior exploitation. Organizations still on legacy Office versions should upgrade to currently supported editions that receive ongoing security updates.