CVE-2016-7193: Microsoft Word RTF memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives code execution with user interaction, is listed in CISA KEV as exploited, and has a very high EPSS score, though it requires a user to open a document.

What it is

Microsoft Word and related Office products mishandle a crafted RTF document, causing a memory corruption (buffer overflow) condition. Because the affected products include Word, Word Viewer, the Office Compatibility Pack, SharePoint Word Automation Services and Office Web Apps, the flaw reaches a wide install base and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who gets the document opened can execute arbitrary code in the context of the victim user, giving full control of confidentiality, integrity and availability on that host.

Attack surface

Reached by delivering a malicious RTF document to a user, who must open it in Word or a related Office component; the CVSS vector is local with user interaction required and no privileges needed. No authentication is required on the attacker's side.

Exploitation

CVE-2016-7193 is in CISA KEV (added 2022-03-03, due 2022-03-24) and EPSS shows a 30-day probability of 0.577 at the 99th percentile, indicating observed exploitation and high likelihood of continued attempts. No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft MS16-121 updates for all affected Word, Office, Word Viewer, Compatibility Pack, SharePoint and Office Web Apps products.
• If patching cannot be completed immediately, block or restrict opening of untrusted RTF files and enforce Protected View / disable RTF handling where feasible.
• Remove or upgrade end-of-life components such as Word Viewer and the Office Compatibility Pack that cannot be fully patched.
• Limit the privileges of users who open Office documents and apply attack surface reduction rules against Office child process creation.

Detection

• Hunt for WINWORD.EXE or other Office processes spawning cmd.exe, powershell.exe, wscript.exe or other unexpected children.
• Monitor for Office documents written to or executed from temp, downloads or email attachment directories, especially .rtf files.
• Alert on known exploit indicators and unusual network connections originating from Office processes.
• Review endpoint and email telemetry for RTF attachments delivered to users who then open them in Word.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.