Product:
Office
Summary
Microsoft Office 2010, Office 2013, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-0261 |
Exploitation
An attacker can exploit this vulnerability by convincing a user to open a specially crafted file in Microsoft Office. This can be done through phishing emails or malicious websites that host the crafted files. Once the file is opened, the attacker can execute arbitrary code on the user’s system, potentially gaining full control over it.
Affected Products
- Microsoft Office 2010 SP2: Vulnerable to remote code execution due to improper handling of memory objects.
- Microsoft Office 2013 SP1: Susceptible to exploitation through crafted files leading to code execution.
- Microsoft Office 2016: Allows attackers to execute arbitrary code when users open malicious documents.
Mitigation
To mitigate this vulnerability, users should apply the updates provided by Microsoft as per their instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.