Product:
Microsoft Word
Summary
Microsoft Word and related products allow remote attackers to execute arbitrary code via a crafted RTF document. This vulnerability is known as the Microsoft Office Memory Corruption Vulnerability. It affects multiple versions of Word and Office products, including those for Mac and SharePoint.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2016-7193 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious RTF document and convince a user to open it in an affected version of Microsoft Word. Once opened, the crafted document can trigger memory corruption, allowing the attacker to execute arbitrary code on the user’s system without requiring authentication.
Affected Products
- Microsoft Word 2007 SP2
- Office 2010 SP2
- Word 2013 SP1
- Word 2013 RT SP1
- Word 2016
- Word for Mac 2011
- Word 2016 for Mac
- Office Compatibility Pack SP3
- Word Viewer
- Word Automation Services on SharePoint Server 2010 SP2
- Word Automation Services on SharePoint Server 2013 SP1
- Office Web Apps 2010 SP2
- Office Web Apps Server 2013 SP1
- Office Online Server
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.