{"id":"CVE-2017-0199","aliases":["EUVD-2017-0566","GHSA-mrf9-75pc-cjmm"],"status":"published","title":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office...","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99497,"percentile":0.99945,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"published":"2017-04-12T14:00:00Z","modified":"2026-06-17T00:57:15Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"SyFi/cve-2017-0199","title":"SyFi/cve-2017-0199","date":"2017-04-13","url":"https://github.com/SyFi/cve-2017-0199"},{"source":"pocgithub","id":"ryhanson/CVE-2017-0199","title":"ryhanson/CVE-2017-0199","date":"2017-04-13","url":"https://github.com/ryhanson/CVE-2017-0199"},{"source":"metasploit","id":"exploit/windows/fileformat/office_word_hta","title":"Microsoft Office Word Malicious Hta Execution","type":"exploit","platform":"Windows","date":"2017-04-14","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/fileformat/office_word_hta"},{"source":"pocgithub","id":"bhdresh/CVE-2017-0199","title":"bhdresh/CVE-2017-0199","date":"2017-04-17","url":"https://github.com/bhdresh/CVE-2017-0199"},{"source":"exploitdb","id":"EDB-41894","title":"Microsoft Word - '.RTF' Remote Code Execution","type":"remote","platform":"windows","date":"2017-04-18","url":"https://www.exploit-db.com/exploits/41894"},{"source":"pocgithub","id":"NotAwful/CVE-2017-0199-Fix","title":"NotAwful/CVE-2017-0199-Fix","date":"2017-04-18","url":"https://github.com/NotAwful/CVE-2017-0199-Fix"},{"source":"pocgithub","id":"haibara3839/CVE-2017-0199-master","title":"haibara3839/CVE-2017-0199-master","date":"2017-04-19","url":"https://github.com/haibara3839/CVE-2017-0199-master"},{"source":"pocgithub","id":"Exploit-install/CVE-2017-0199","title":"Exploit-install/CVE-2017-0199","date":"2017-04-22","url":"https://github.com/Exploit-install/CVE-2017-0199"},{"source":"pocgithub","id":"mzakyz666/PoC-CVE-2017-0199","title":"mzakyz666/PoC-CVE-2017-0199","date":"2017-04-22","url":"https://github.com/mzakyz666/PoC-CVE-2017-0199"},{"source":"pocgithub","id":"n1shant-sinha/CVE-2017-0199","title":"n1shant-sinha/CVE-2017-0199","date":"2017-04-23","url":"https://github.com/n1shant-sinha/CVE-2017-0199"},{"source":"pocgithub","id":"kn0wm4d/htattack","title":"kn0wm4d/htattack","date":"2017-04-24","url":"https://github.com/kn0wm4d/htattack"},{"source":"exploitdb","id":"EDB-41934","title":"Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)","type":"remote","platform":"windows","date":"2017-04-25","verified":true,"url":"https://www.exploit-db.com/exploits/41934"},{"source":"pocgithub","id":"sUbc0ol/Microsoft-Word-CVE-2017-0199-","title":"sUbc0ol/Microsoft-Word-CVE-2017-0199-","date":"2017-06-30","url":"https://github.com/sUbc0ol/Microsoft-Word-CVE-2017-0199-"},{"source":"pocgithub","id":"viethdgit/CVE-2017-0199","title":"viethdgit/CVE-2017-0199","date":"2017-09-19","url":"https://github.com/viethdgit/CVE-2017-0199"},{"source":"exploitdb","id":"EDB-42995","title":"Microsoft Excel - OLE Arbitrary Code Execution","type":"dos","platform":"windows","date":"2017-09-30","url":"https://www.exploit-db.com/exploits/42995"},{"source":"pocgithub","id":"nicpenning/RTF-Cleaner","title":"nicpenning/RTF-Cleaner","date":"2017-11-03","url":"https://github.com/nicpenning/RTF-Cleaner"},{"source":"pocgithub","id":"herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199","title":"herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199","date":"2017-11-17","url":"https://github.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199"},{"source":"pocgithub","id":"jacobsoo/RTF-Cleaner","title":"jacobsoo/RTF-Cleaner","date":"2017-12-08","url":"https://github.com/jacobsoo/RTF-Cleaner"},{"source":"pocgithub","id":"likekabin/CVE-2017-0199","title":"likekabin/CVE-2017-0199","date":"2018-03-22","url":"https://github.com/likekabin/CVE-2017-0199"},{"source":"pocgithub","id":"stealth-ronin/CVE-2017-0199-PY-KIT","title":"stealth-ronin/CVE-2017-0199-PY-KIT","date":"2020-10-18","url":"https://github.com/stealth-ronin/CVE-2017-0199-PY-KIT"},{"source":"pocgithub","id":"Phantomlancer123/CVE-2017-0199","title":"Phantomlancer123/CVE-2017-0199","date":"2022-04-20","url":"https://github.com/Phantomlancer123/CVE-2017-0199"},{"source":"pocgithub","id":"BRAINIAC22/CVE-2017-0199","title":"BRAINIAC22/CVE-2017-0199","date":"2022-04-22","url":"https://github.com/BRAINIAC22/CVE-2017-0199"},{"source":"pocgithub","id":"Sunqiz/CVE-2017-0199-reprofuction","title":"Sunqiz/CVE-2017-0199-reprofuction","date":"2022-08-15","url":"https://github.com/Sunqiz/CVE-2017-0199-reprofuction"},{"source":"pocgithub","id":"TheCyberWatchers/CVE-2017-0199-v5.0","title":"TheCyberWatchers/CVE-2017-0199-v5.0","date":"2023-09-02","url":"https://github.com/TheCyberWatchers/CVE-2017-0199-v5.0"},{"source":"pocgithub","id":"kash-123/CVE-2017-0199","title":"kash-123/CVE-2017-0199","date":"2024-09-10","url":"https://github.com/kash-123/CVE-2017-0199"},{"source":"pocgithub","id":"ahmed-tarek22752/security-vulnerability-in-Microsoft-Office.","title":"ahmed-tarek22752/security-vulnerability-in-Microsoft-Office.","date":"2025-11-23","url":"https://github.com/ahmed-tarek22752/security-vulnerability-in-Microsoft-Office."},{"source":"pocgithub","id":"BlackOclock/XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant","title":"BlackOclock/XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant","date":"2026-03-12","url":"https://github.com/BlackOclock/XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant"}],"products":[{"vendor":"microsoft","product":"office"},{"vendor":"microsoft","product":"office and wordpad"},{"vendor":"microsoft","product":"windows_7"},{"vendor":"microsoft","product":"windows_server_2008"},{"vendor":"microsoft","product":"windows_server_2012"},{"vendor":"microsoft","product":"windows_vista"},{"vendor":"microsoft corporation","product":"office/wordpad"},{"vendor":"philips","product":"intellispace_portal"}],"references":[{"url":"http://www.securityfocus.com/bid/97498","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41894/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Exploit","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41934/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42995/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038224","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199"},{"url":"https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document"},{"url":"https://www.exploit-db.com/exploits/41894"},{"url":"https://www.exploit-db.com/exploits/41934"},{"url":"https://www.exploit-db.com/exploits/42995"},{"url":"https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability"},{"url":"https://github.com/advisories/GHSA-mrf9-75pc-cjmm"}],"sources":{"cve":[{"id":"CVE-2017-0199","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","status":"published","published":"2017-04-12T14:00:00Z","modified":"2025-10-21T23:55:42.609Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:22.699876Z"}],"euvd":[{"id":"EUVD-2017-0566","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","status":"published","published":"2017-04-12T14:00:00Z","modified":"2025-10-21T23:55:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T19:49:39.684828Z"}],"ghsa":[{"id":"GHSA-mrf9-75pc-cjmm","title":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office...","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","status":"published","published":"2022-05-13T01:39:49Z","modified":"2025-10-22T00:31:20Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:04:03.556367Z"}],"kev":[{"id":"CVE-2017-0199","title":"Microsoft Office and WordPad Remote Code Execution Vulnerability","description":"Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2017-0199","description":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","status":"published","published":"2017-04-12T14:59:01.157Z","modified":"2026-06-17T00:57:15.43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:44.86906Z"}]}}