Prioritize patching. It under exploitation confirmed by CISA.
ssvc Actcvss 7.8epss 63%
from disclosure to weapon
Published on NVDJun 10
CISA KEV+4746d
exploitation probability
63%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2022-06-22
Apply updates per vendor instructions.
In short
A flaw in Microsoft Word allows attackers to run harmful code on your computer by sending you a specially crafted Word document. The vulnerability exists because Word doesn't properly check the size of data in certain document elements, causing a memory overflow.
Technical detail
Stack-based buffer overflow in Word's document parsing due to improper validation of length fields in crafted tags (CWE-787). Remote code execution via malicious Word document; no user privileges required beyond opening the file. Affects Word 2002 SP3, 2003 SP3, 2007 SP1/SP2, Word Viewer variants, and Office Compatibility Pack.
Summary generated and translated by AI from the official description.
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."