CVE-2017-0199

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Published: 2017-04-12

Community Advisory

This section is open source, for any additional information that enhances or clarifies the official advisory above.

Improve Advisory

CVE-2017-0199 Exploits (24)

• bhdresh/CVE-2017-0199 ( 646)
• haibara3839/CVE-2017-0199-master ( 16)
• NotAwful/CVE-2017-0199-Fix ( 14)
• SyFi/cve-2017-0199 ( 12)
• Exploit-install/CVE-2017-0199 ( 8)
• kn0wm4d/htattack ( 4)
• jacobsoo/RTF-Cleaner ( 3)
• nicpenning/RTF-Cleaner ( 3)
• sUbc0ol/Microsoft-Word-CVE-2017-0199- ( 2)
• bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-0199 ( 1)

Show all exploits (+14):

• zakybstrd21215/PoC-CVE-2017-0199 ( 1)
• n1shant-sinha/CVE-2017-0199 ( 1)
• rapid7/metasploit-framework/modules/exploits/windows/fileformat/office_word_hta.rb
• 530tatted530/CVE-2017-0199
• joke998/Cve-2017-0199
• joke998/Cve-2017-0199-
• stealth-ronin/CVE-2017-0199-PY-KIT
• viethdgit/CVE-2017-0199
• Djangoat/cve-2017-0199-py-kit
• 41894
• 41934
• 42995
• ryhanson/CVE-2017-0199
• likescam/CVE-2017-0199

Research Labs

Official CVE References

View references (11)

• blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
• securityfocus.com/bid/97498
• securitytracker.com/id/1038224
• nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
• us-cert.gov/advisories/ICSMA-18-058-02
• msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
• 41894
• 41934
• 42995
• fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
• mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/