⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.
CVE-2017-0199 — Code Injection in Corporation Office Wordpad
Severity
7.8HIGHNVD
VulnCheck9.8VulnCheck8.8
EPSS
94.3%
top 0.05%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedApr 12
KEV addedNov 3
KEV dueMay 3
Latest updateMar 6
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages14 packages
▶CVEListV5microsoft_corporation/office_wordpadOffice 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1
Patches
🔴Vulnerability Details
7GHSA▶
GHSA-mrf9-75pc-cjmm: Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 20↗2022-05-13
💥Exploits & PoCs
5🔍Detection Rules
12📋Vendor Advisories
2🕵️Threat Intelligence
235📄Research Papers
8arXiv▶
CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis↗2025-07-12
arXiv▶
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures↗2025-02-12
arXiv▶
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting↗2021-02-10