CVE-2017-0262
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.
Analysis
Microsoft Office 2010 through 2016 allows remote code execution through improper handling of memory objects, exploited by APT28 in targeted campaigns alongside CVE-2017-0263 kernel escalation.
Technical Context
The vulnerability occurs when Office processes crafted EPS (Encapsulated PostScript) content embedded in documents. The EPS filter's memory handling flaw allows arbitrary code execution when the document is opened or previewed.
Affected Products
['Microsoft Office 2010 SP2', 'Microsoft Office 2013 SP1', 'Microsoft Office 2016']
Remediation
Apply Microsoft security update. Microsoft subsequently disabled EPS rendering in Office entirely (CVE-2017-0261 patch). Ensure EPS filters are disabled.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today