Microsoft Office and Word Memory Corruption Remote Code Execution Vulnerability (CVE-2016-7193, MS16-121)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Word 2007 to 2016, Word for Mac 2011/2016, Word Automation Services on SharePoint Server, Office Web Apps, and Office Online Server.
Remote attackers can execute arbitrary code under the security context of the current user by tricking them into opening a specially crafted RTF document.
Apply the official MS16-121 security updates immediately, or implement File Block policies via Registry/GPO to restrict RTF document parsing.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Deploy the official security updates associated with MS16-121. You can force the installation of the required KB patches on Windows endpoints using the following PowerShell commands:
# Install Windows Update module and apply MS16-121 related patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB3194063, KB3118312 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be immediately scheduled, enforce File Block settings via the Windows Registry to prevent Microsoft Word from opening RTF files.
Windows Registry Editor Version 5.00
; Block opening of RTF files in Word 2016
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security\FileOpenBlock]
"RtfFiles"=dword:00000002
"FilesBeforeVersion"=dword:000000023. Log Audit & IoC Verification Commands
Use the following PowerShell script to audit the installed version of Microsoft Word and verify if the system is running a vulnerable build.
# Retrieve and verify the executable version of Microsoft Word
$wordPath = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\winword.exe' -ErrorAction SilentlyContinue).'(default)'
if ($wordPath) {
$version = (Get-Item $wordPath).VersionInfo.ProductVersion
Write-Host 'Detected Word Version: ' $version
# Note: For Word 2016, ensure the patched version is 16.0.4441.1000 or higher
} else {
Write-Host 'Microsoft Word is not detected on this system.'
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2016-7193) is a memory corruption flaw within Microsoft Office and Word's parsing engine. The root cause lies in the improper handling of memory objects when parsing Rich Text Format (RTF) files. When processing specifically crafted control words or nested structures within an RTF document, the parser fails to validate buffer boundaries, leading to a buffer overflow or invalid pointer dereference (CWE-119).
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by crafting a malicious RTF file containing malformed structures designed to corrupt the application's memory heap or stack. This file is typically distributed via spear-phishing emails or hosted on compromised websites. When a target user opens the document using an affected version of Word or previews it in Outlook, the memory corruption is triggered, allowing the attacker to hijack the execution flow and run arbitrary shellcode with the user's privileges.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV catalog, CVE-2016-7193 poses a severe threat due to its history of active exploitation in the wild. Successful exploitation grants the attacker initial access to the endpoint, which can lead to lateral movement, domain compromise, sensitive data exfiltration, and deployment of ransomware across the corporate network.
Official Vendor Advisories & References
Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
Frequently Asked SecOps Questions (CVE-2016-7193)
FAQQ1. How critical is CVE-2016-7193 and is it actively exploited in the wild?
CVE-2016-7193 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 57.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2016-7193?
Primary impacted vendors include microsoft across word, office, office_compatibility_pack, word_viewer, sharepoint_server, office_web_apps, office_web_apps_server, office_online_server. Scope summary: Microsoft Word 2007 SP2, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Word for Mac 2011/2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010/2013, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server.
Q3. What temporary mitigations or workarounds exist for CVE-2016-7193 before patching?
[Mitigation] Apply the official MS16-121 security updates immediately, or implement File Block policies via Registry/GPO to restrict RTF document parsing. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2016-7193
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Office Word Security Feature Bypass Vulnerability (CVE-2026-21514) Analysis and Mitigation Guide
[Affected Scope] Microsoft Office Word and associated Office suites
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.