CVE-2023-21716criticalobserved exploitationCWE-190

CVE-2023-21716: critical vulnerability in Microsoft 365 Apps for Enterprise

Microsoft Word Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Office+ Monitor Microsoft 365 Apps

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

94Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 85%
from disclosure to weapon21 days
Published on NVDFeb 14
1st PoC+21d
VulnCheck+401d
In short

A critical vulnerability in Microsoft Word allows an attacker to execute arbitrary code on a victim's computer by tricking them into opening a specially crafted document. This can lead to complete system compromise without requiring any special user permissions.

Technical detail

An integer overflow vulnerability (CWE-190) in Microsoft Word's document parsing engine allows remote code execution when processing maliciously crafted Word files. The attack vector is document opening via email or web download; no user interaction beyond opening the file is required, enabling unauthenticated RCE with CVSS 9.8 severity.

Summary generated and translated by AI from the official description.
Microsoft Word Remote Code Execution Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft 365 Apps for EnterpriseMicrosoft · Microsoft Office 2019Microsoft · Microsoft Office 2019 for MacMicrosoft · Microsoft Office LTSC 2021Microsoft · Microsoft Office LTSC for Mac 2021Microsoft · Microsoft Office Online ServerMicrosoft · Microsoft Office Web Apps Server 2013 Service Pack 1Microsoft · Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft · Microsoft SharePoint Enterprise Server 2016Microsoft · Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft · Microsoft SharePoint Server 2019Microsoft · Microsoft SharePoint Server Subscription EditionMicrosoft · Microsoft Word 2013 Service Pack 1Microsoft · Microsoft Word 2016Microsoft · SharePoint Server Subscription Edition Language Pack
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft 365 Apps for Enterprise

In the same product, most dangerous first.

CVE-2023-23397CRITICALMicrosoft Outlook Elevation of Privilege VulnerabilityEPSS 97.2%KEVCVE-2024-21413CRITICALMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 94.7%KEVCVE-2026-21509HIGHMicrosoft Office Security Feature Bypass VulnerabilityEPSS 70.8%KEVCVE-2021-42292HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 43.0%KEVCVE-2023-36761MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 19.6%KEVCVE-2023-35311HIGHMicrosoft Outlook Security Feature Bypass VulnerabilityEPSS 15.5%KEV