CVE-2017-0262: Microsoft Office memory handling flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA's KEV catalog with a very high EPSS score, but exploitation requires local access and user interaction, and the affected Office versions are legacy.

What it is

Microsoft Office 2010 SP2, 2013 SP1 and 2016 fail to properly handle objects in memory, producing a remote code execution vulnerability. Because the flaw is memory-corruption related and reachable through Office document processing, it matters for any environment still running these Office versions.

Impact

An attacker who gets code to run gains execution in the context of the current user, which can lead to full compromise of that user's data and, depending on privileges, the host.

Attack surface

The CVSS vector is local with user interaction required (AV:L/UI:R), so the victim must open or interact with a crafted file; no authentication is needed (PR:N). The description does not specify the exact file format or component involved.

Exploitation

CVE-2017-0262 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), indicating exploitation in the wild, and EPSS gives a 30-day probability of 0.81005 (99.61st percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0262 on all affected Office 2010 SP2, 2013 SP1 and 2016 installations.
• Prioritize patching per the CISA KEV due date of 2022-08-10 if any affected systems remain unpatched.
• Block or restrict opening of untrusted Office documents from email and web sources until patching is complete.
• Enable Office Protected View and disable macros for documents from external sources to reduce the chance of successful exploitation.
• Retire or isolate end-of-support Office versions that cannot receive current security fixes.

Detection

• Monitor for Office application processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office processes making unusual network connections or writing executables to user-writable directories.
• Hunt for documents exploiting memory corruption patterns, such as malformed embedded objects, opened from email attachments or downloads.
• Correlate endpoint telemetry for crashes in Office processes followed by suspicious child process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.