Product:
Office
Summary
Microsoft Office 2010, Office 2013, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory. This vulnerability can lead to complete compromise of the affected system, allowing attackers to execute arbitrary code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-0262 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious document that, when opened by a user, triggers the vulnerability. The attacker can then execute arbitrary code on the user’s system, potentially gaining full control over it. User interaction is required, as the malicious document must be opened by the victim.
Affected Products
- Office 2010 SP2: Vulnerable to remote code execution due to improper handling of memory objects.
- Office 2013 SP1: Similar vulnerability allowing remote code execution when handling memory objects incorrectly.
- Office 2016: Also affected by the same remote code execution vulnerability related to memory management.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping software up to date is crucial in protecting against known vulnerabilities.