⚠ Actively exploited
Added to CISA KEV on 2022-02-15. Federal agencies required to patch by 2022-08-15. Required action: Apply updates per vendor instructions..
CVE-2014-1761
Severity
7.8HIGH
EPSS
92.6%
top 0.26%
CISA KEV
KEV
Added 2022-02-15
Due 2022-08-15
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedMar 25
KEV addedFeb 15
Latest updateMay 14
KEV dueAug 15
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages5 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-f32r-xw6q-p85m: Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automati↗2022-05-14
CVEList▶
CVE-2014-1761: Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automati↗2014-03-24