CVE-2017-0199

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Apr 12, 2017
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-02007.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memoCVE-2017-02017.5A remote code execution vulnerability exists in Internet Explorer in the way that the JScript and VBScript engines render when handling objeCVE-2017-02027.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt mCVE-2017-02034.3A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted doCVE-2017-02045.5Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypCVE-2017-02057.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memoCVE-2017-02076.5Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft BrowCVE-2017-02084.3An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memoryCVE-2017-02108.8An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an CVE-2017-02115.5An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and CVE-2017-02127.6Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016CVE-2017-02137.3Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2
CVE-2017-0199: High severity, CVSS 7.8 | Vulnix