CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
AnalysisAI
Remote code execution in Microsoft Office 2007-2016 allows attackers to execute arbitrary code with user privileges by delivering malicious documents containing specially crafted embedded objects. Confirmed actively exploited (CISA KEV) with multiple public exploit tools available. EPSS score of 94.25% (100th percentile) indicates near-certain exploitation attempts against vulnerable systems. Attack requires local file access and user interaction (opening the malicious document), but once triggered achieves full code execution with high impact to confidentiality, integrity, and availability. Microsoft released patches in July 2017; unpatched systems remain high-priority targets for document-based attacks.
Technical ContextAI
This vulnerability exploits Microsoft Office's Composite Moniker object handling mechanism, specifically the way Office processes embedded objects through the COM (Component Object Model) subsystem. Attackers craft malicious Office documents (particularly PowerPoint .ppsx files) containing specially structured OLE (Object Linking and Embedding) objects that trigger unsafe deserialization or object instantiation. The Composite Moniker allows chaining multiple monikers together, enabling attackers to reference remote script resources (typically hosted via HTTP) that execute when the document is opened. CPE data confirms affected versions span Office 2007 SP3, 2010 SP2, 2013 SP1 (including RT), and 2016 (both x86 and x64 architectures). While no CWE is formally assigned, the vulnerability pattern aligns with unsafe object handling and deserialization issues common in complex document processing engines. The attack surface exists because Office must support legitimate OLE embedding features for backward compatibility, creating opportunities for abuse when object references are not properly validated.
RemediationAI
Apply Microsoft's July 2017 Security Update for Office, which addresses CVE-2017-8570 across all affected versions (2007 SP3, 2010 SP2, 2013 SP1, 2016). Patches available through Windows Update, Microsoft Update Catalog, or the vendor advisory at https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8570. For systems that cannot immediately patch, implement Protected View for all Office document sources (configured via Group Policy or Trust Center settings) to force documents into sandboxed read-only mode, though this reduces productivity and may be bypassed by users. Disable OLE package activation through registry modifications (HKEY_CURRENT_USER\Software\Microsoft\Office\[version]\[application]\Security\PackagerPrompt set to 2), which prevents automatic execution of embedded objects but may break legitimate documents containing embedded content. Email gateway filtering should block or quarantine Office documents with embedded Composite Moniker objects or remote OLE references. User awareness training should emphasize risks of opening Office documents from untrusted sources, though social engineering success rates make this a weak compensating control. Given the vulnerability's age and confirmed exploitation, patching remains the only reliable long-term mitigation.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today