CVE-2014-1761: Microsoft Word RTF memory corruption remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable through user-opened documents, has a CVSS 3.1 base score of 7.8, is in CISA KEV with confirmed in-the-wild exploitation, and carries a very high EPSS score.

What it is

Microsoft Word and related Office components mishandle crafted RTF data, causing an out-of-bounds write (CWE-787) that corrupts memory. The flaw affects Word 2003 through 2013, Word Viewer, Office Compatibility Pack, Office for Mac 2011, and Word Automation Services/Office Web Apps on SharePoint. It matters because it was exploited in the wild in March 2014 and allows code execution in the context of the user opening the document.

Impact

An attacker who gets a crafted RTF document opened can execute arbitrary code with the privileges of the victim, or crash the application to cause a denial of service. Successful exploitation gives full control of confidentiality, integrity and availability on the affected host.

Attack surface

Reached by delivering a malicious RTF file or RTF content to a target, typically via email attachment, web page or document. The CVSS vector shows local access with user interaction required (UI:R) and no privileges required (PR:N), so the victim must open or preview the crafted content.

Exploitation

Listed in CISA KEV since 2022-02-15 and described by NVD as exploited in the wild in March 2014. EPSS 30-day probability is 0.7746 (99.5th percentile), indicating high likelihood of attempted exploitation.

What to do

• Apply the Microsoft MS14-017 security update and the associated advisory 2953095 fixes to all affected Word, Office, SharePoint and Office Web Apps components.
• Disable or restrict opening of RTF content in Word and block RTF attachments at email and web gateways where business needs allow.
• Use Microsoft's Fix it or registry workarounds from advisory 2953095 to mitigate until patching is complete.
• Retire unsupported products in the affected list, such as Word 2003 and Word Viewer, that no longer receive security updates.
• Enforce attachment filtering and macro/ActiveX restrictions to reduce delivery of malicious documents.

Detection

• Monitor for Word, Word Viewer or Office processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe after opening documents.
• Search email and web proxy logs for RTF attachments or RTF content delivered to endpoints, especially from external senders.
• Hunt for Office crash events and memory-corruption-related application error reports tied to WINWORD.EXE or related binaries.
• Review endpoint telemetry for suspicious file writes or network connections originating from Office processes shortly after document open.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.