---
id: "CVE-2017-0199"
kind: "vulnerability"
aliases: ["CVE-2017-0199"]
title: "Microsoft Office and WordPad: Microsoft Office and WordPad Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.99497
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Office and WordPad", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "office", "ransomware", "windows", "wordpad"]
not_affected_if: ["unknown"]
published_at: "2017-04-12T14:59:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0199", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-0199", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0199", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft Office and WordPad: Microsoft Office and WordPad Remote Code Execution Vulnerability

Microsoft Office and WordPad mishandle specially crafted files, letting an attacker run code on the machine that opens the file. It is listed as actively exploited and tied to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office and WordPad affected ? fixed ?

## How to check

Check that Microsoft Office and WordPad are patched via Windows Update or the Microsoft Update Catalog; the sources do not give a specific file or version to inspect.

## Fix

Apply the Microsoft updates for Office and WordPad per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0199
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-0199
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-0199

## From the sources

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_