CVE-2017-0199: Microsoft Office and WordPad remote code execution via crafted document

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with known ransomware use, has an EPSS score above 0.99, and public exploit code exists, making active exploitation highly likely.

What it is

CVE-2017-0199 is a remote code execution flaw in Microsoft Office and WordPad that is triggered when a user opens a specially crafted document. The record does not specify the exact underlying coding error, and NVD classifies the weakness as insufficient information. It matters because the flaw is in widely deployed Office and Windows components and has been exploited in real attacks.

Impact

An attacker can execute arbitrary code in the context of the user who opens the document, giving full control over confidentiality, integrity and availability on that host. Because the flaw is in Office and WordPad, the attacker gains the privileges of the logged-on user rather than requiring a separate elevation step.

Attack surface

The attack is reached locally through a crafted document opened by the victim, so user interaction is required and no authentication is needed. The CVSS vector AV:L/UI:R reflects that the malicious file must be delivered to and opened on the target system.

Exploitation

Exploitation is confirmed: the CVE is in CISA's Known Exploited Vulnerabilities catalog with a known ransomware campaign use flag, and multiple references are tagged as Exploit. EPSS is 0.99933 (99.97th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for all affected Office, WordPad and Windows versions.
• Disable or restrict the handling of RTF and embedded OLE objects in Office where business needs allow.
• Block or quarantine untrusted Office documents at email and web gateways, and strip active content from inbound files.
• Enforce least privilege so users do not operate with administrative rights, limiting the impact of code execution.
• Use Microsoft Office Protected View and Attack Surface Reduction rules to prevent Office applications from launching child processes.

Detection

• Monitor for Office or WordPad processes spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe or mshta.exe.
• Alert on outbound network connections or file downloads initiated by Office or WordPad processes.
• Search email and file shares for RTF and Office documents containing embedded OLE objects or remote template references.
• Review endpoint telemetry for known exploit artifacts associated with CVE-2017-0199, such as HTA handler abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.