CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Office & WordPad OLE Remote Code Execution Vulnerability (CVE-2017-0199) Deep Dive & Mitigation Guide
[Affected Scope] Microsoft Office 2007/2010/2013/2016, Windows Vista/7/8.1, and Windows Server 2008
[Impact] Remote attackers can execute arbitrary code with the logged-in user's privileges by enticing a user to open a specially crafted document
[Mitigation] Apply official Microsoft security patches immediately, restrict opening untrusted documents, and disable automatic OLE link updates via registry hardening
Microsoft Office and Word Memory Corruption Remote Code Execution Vulnerability (CVE-2016-7193, MS16-121)
[Affected Scope] Microsoft Word 2007 to 2016, Word for Mac 2011/2016, Word Automation Services on SharePoint Server, Office Web Apps, and Office Online Server.
[Impact] Remote attackers can execute arbitrary code under the security context of the current user by tricking them into opening a specially crafted RTF document.
[Mitigation] Apply the official MS16-121 security updates immediately, or implement File Block policies via Registry/GPO to restrict RTF document parsing.
Microsoft Office RTF Memory Corruption Vulnerability (CVE-2015-1641, MS15-033) Technical Analysis and Mitigation Guide
[Affected Scope] Microsoft Word 2007/2010/2013, Office 2010/2013, Word for Mac 2011, SharePoint Server 2010/2013, and Office Web Apps Server 2010/2013
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by enticing them to open a specially crafted RTF document
[Mitigation] Immediately apply the official Microsoft security updates (MS15-033) or implement registry-based File Block policies to restrict RTF parsing
Microsoft Office RTF Stack Buffer Overflow Remote Code Execution Vulnerability (CVE-2010-3333)
[Affected Scope] Microsoft Office XP SP3, 2003 SP3, 2007 SP2, 2010, and Office for Mac 2004, 2008, 2011
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a crafted RTF file
[Mitigation] Apply the official Microsoft MS10-087 security patch, or configure File Block settings via Registry to restrict RTF file parsing