Product:
Microsoft Word
Summary
Microsoft Word and related products allow remote attackers to execute arbitrary code via a crafted RTF document. This vulnerability is known as the Microsoft Office Memory Corruption Vulnerability. It affects various versions of Word and Office products, enabling potential exploitation through specially crafted documents.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2015-1641 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious RTF document and convince a user to open it. This can be done through phishing emails or other social engineering tactics. Once the document is opened, the attacker can execute arbitrary code on the victim’s machine, potentially leading to full system compromise.
Affected Products
- Microsoft Word 2007 SP3
- Office 2010 SP2
- Word 2010 SP2
- Word 2013 SP1
- Word 2013 RT SP1
- Word for Mac 2011
- Office Compatibility Pack SP3
- Word Automation Services on SharePoint Server 2010 SP2
- Word Automation Services on SharePoint Server 2013 SP1
- Office Web Apps Server 2010 SP2
- Office Web Apps Server 2013 SP1
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.