CVE-2002-1143: Microsoft Word and Excel field codes leak local data to remote attackers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 2.0 rates this 5.0 (medium) with only partial confidentiality impact, but high EPSS and a public exploit reference raise the practical risk for document-heavy environments.

What it is

Microsoft Word and Excel process certain field codes, such as INCLUDETEXT and INCLUDEPICTURE, that pull in external content when a document is opened or updated. A crafted document can cause the victim's application to insert sensitive local information into the file, which is then returned to the attacker when the document is sent back. This is an information disclosure flaw in widely deployed office software.

Impact

An attacker gains read access to sensitive information from the victim's system that is embedded into the returned document; there is no integrity or availability impact. The exposure is limited to partial confidentiality loss rather than full system compromise.

Attack surface

Reached remotely over the network with no authentication required, per the CVSS vector AV:N/AC:L/Au:N. Exploitation depends on the victim opening or updating a malicious document and returning it, so user interaction is effectively required even though the vector does not encode it.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.536 (99th percentile), and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Apply the vendor patch referenced in Microsoft Security Bulletin MS02-059 and the Microsoft Word security guidance page.
• Disable or restrict automatic update of external links and field codes in Word and Excel, and block INCLUDETEXT and INCLUDEPICTURE fields in untrusted documents.
• Treat documents from external or untrusted sources as hostile; open them in a sandbox or Protected View and avoid returning edited copies to the sender.
• Use document inspection or policy controls to strip field codes and external references before documents leave the environment.

Detection

• Monitor for Word or Excel documents containing INCLUDETEXT or INCLUDEPICTURE field codes, especially in inbound mail attachments.
• Alert on outbound documents or email containing embedded local file paths or content pulled from the host.
• Review endpoint logs for Office processes making unexpected external file or network requests during document open or field update.
• Hunt for repeated document round-trips to external recipients that coincide with field-code insertion activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.