Product:
Microsoft Word
Summary
Microsoft Word and related products allow remote attackers to execute arbitrary code or cause a denial of service via crafted RTF data. This vulnerability was actively exploited in the wild in March 2014. Affected versions include Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and others.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2014-1761 |
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted RTF document to a user. When the user opens the document in an affected version of Microsoft Word, the crafted data can trigger memory corruption, allowing the attacker to execute arbitrary code or cause a denial of service.
Affected Products
- Microsoft Word 2003 SP3
- Microsoft Word 2007 SP3
- Microsoft Word 2010 SP1 and SP2
- Microsoft Word 2013
- Word Viewer
- Office Compatibility Pack SP3
- Office for Mac 2011
- Word Automation Services on SharePoint Server 2010 SP1 and SP2
- Office Web Apps 2010 SP1 and SP2
- Office Web Apps Server 2013
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.