CVE-2017-0262: high-severity vulnerability in Microsoft Office
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Microsoft Office versions 2010, 2013, and 2016 have a vulnerability that allows attackers to run malicious code on your computer if you open a specially crafted Office document. This happens because the software doesn't safely manage data in memory.
A memory handling flaw in Microsoft Office 2010 SP2, 2013 SP1, and 2016 enables remote code execution when processing maliciously crafted Office documents. The attack vector requires user interaction (opening a document), and successful exploitation results in arbitrary code execution with the privileges of the affected user.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.