{"id":"CVE-2017-0199","kind":"vulnerability","aliases":["CVE-2017-0199"],"related":[],"title":"Microsoft Office and WordPad: Microsoft Office and WordPad Remote Code Execution Vulnerability","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","summary":"Microsoft Office and WordPad mishandle specially crafted files, letting an attacker run code on the machine that opens the file. It is listed as actively exploited and tied to ransomware campaigns.","severity":"critical","cvss":9.3,"epss":0.99497,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Office and WordPad","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","office","ransomware","windows","wordpad"],"not_affected_if":["unknown"],"how_to_check":"Check that Microsoft Office and WordPad are patched via Windows Update or the Microsoft Update Catalog; the sources do not give a specific file or version to inspect.","fix":"Apply the Microsoft updates for Office and WordPad per vendor instructions, as CISA requires.","status":"open","published_at":"2017-04-12T14:59:01+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:39:20+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:39:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Office and WordPad per vendor instructions, as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"Microsoft Office and WordPad mishandle specially crafted files, letting an attacker run code on the machine that opens the file. It is listed as actively exploited and tied to ransomware campaigns.","category":"infrastructure","who_cares":["windows","office","wordpad"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the victim machine via a crafted document.","analyst_note":"Sources give no affected or fixed versions and no detection method; check Microsoft's security update guide for CVE-2017-0199 for the patched builds and mitigation details.","how_to_check":"Check that Microsoft Office and WordPad are patched via Windows Update or the Microsoft Update Catalog; the sources do not give a specific file or version to inspect.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2851,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0199':15A,18A '-2017':14A,17A '2007':62C '2008':81C '2010':66C '2013':70C '2016':74C '7':84C '8.1':87C 'activ':53B 'aka':99C 'allow':88C 'and':21A 'api':107C 'arbitrari':93C 'attack':39B,90C 'campaign':59B 'code':10A,41B,94C,103C 'craft':35B,97C 'cve':13A,16A 'document':98C 'execut':11A,92C,104C 'exploit':23B,54B 'file':36B,48B 'infrastructur':24B 'let':37B 'list':51B 'machin':44B 'microsoft':1A,5A,19A,29B,60C,64C,68C,72C,75C,100C 'mishandl':33B 'offic':2A,6A,25B,30B,61C,65C,69C,73C 'office':20A 'office/wordpad':101C 'open':46B 'ransomwar':26B,58B 'remot':9A,89C,102C 'run':40B 'server':80C 'sp1':71C,85C 'sp2':67C,78C,82C 'sp3':63C 'special':34B 'tie':56B 'via':95C 'vista':77C 'vulner':12A,105C 'w/windows':106C 'window':27B,76C,79C,83C,86C 'wordpad':4A,8A,22A,28B,32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-04-12T14:59:01+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0199","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0199","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:33+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0199","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0199","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0199","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199","severity":null,"published_at":"2017-04-12T14:59:01+00:00","modified_at":"2026-06-17T00:57:15+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}