Skip to content
Fencer Intel
high 7.8

CVE-2017-0199 kev+ ransomware in the critical feed json

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Window…

published 2017-04-12 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-0566

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03, used in ransomware
epss
99.5%
EPSS 99.5% chance of exploitation in 30 days, percentile 99.9%
public exploits
4
Metasploit, Exploit-DB

Summary

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Patch / fix

cisa required action Apply updates per vendor instructions.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-18-058-02 updated cvss 7.8

Philips Intellispace Portal ISP Vulnerabilities

  • Phillips IntelliSpace Portal 7.0.x Phillips IntelliSpace Portal 8.0.x
    affected: mitigation “Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.” usa.philips.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. 0-day patched (Project Zero)
  2. Published
  3. First public exploit (Metasploit exploit/windows/fileformat/office_word_hta)
  4. Added to CISA KEV
  5. CISA patch deadline
  6. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Microsoft, Office and WordPad
CISA name
Microsoft Office and WordPad Remote Code Execution Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched
2017-04-11
Details
project zero tracker

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

99.50% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/fileformat/office_word_hta Microsoft Office Word Malicious Hta Execution metasploit exploit, excellent rank, 2017-04-14
  • EDB-42995 Microsoft Excel - OLE Arbitrary Code Execution dos, 2017-09-30
  • EDB-41934 Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit) remote, 2017-04-25
  • EDB-41894 Microsoft Word - '.RTF' Remote Code Execution remote, 2017-04-18
  • blog.nviso.be https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/ referenced PoC, tagged "exploit" by a source, unverified
  • rewtin.blogspot.nl http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html referenced PoC, tagged "exploit" by a source, unverified
  • fireeye.com https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html referenced PoC, tagged "exploit" by a source, unverified
  • mdsec.co.uk https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Microsoft Corporation Office/WordPad

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.