CVE-2017-8570: Microsoft Office memory handling remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityConfirmed in-the-wild exploitation (CISA KEV) combined with public exploit code and a very high EPSS score makes unpatched exposure urgent.

What it is

Microsoft Office mishandles objects in memory, allowing remote code execution. The record gives no root-cause detail beyond this, but the flaw is remotely reachable and has been exploited in the wild, so it remains a serious risk on unpatched Office installations.

Impact

An attacker who gets code to run gains full control of the affected user's context, with high confidentiality, integrity and availability impact per the CVSS vector. This typically means arbitrary code execution as the logged-on user.

Attack surface

The CVSS vector is local with user interaction required (AV:L/AC:L/PR:N/UI:R), meaning the victim must open a crafted file or otherwise trigger the vulnerable Office code; no authentication is needed. The description does not name the specific file format or component involved.

Exploitation

CVE-2017-8570 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-25), and public exploit code is referenced, so exploitation is confirmed and tooling is available. EPSS is very high (0.899, 99.8th percentile), indicating strong likelihood of attempted exploitation.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8570 on all affected Office installations.
• Prioritize patching per the CISA KEV due date (2022-08-25) if any systems remain unpatched.
• Block or sandbox untrusted Office documents at email and web gateways, and disable macros and embedded object execution where business needs allow.
• Run Office with reduced privileges and enforce Protected View / Attack Surface Reduction rules for Office child processes.

Detection

• Monitor for Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe or mshta.exe.
• Alert on Office processes making outbound network connections or writing executables to user-writable paths.
• Hunt for documents matching known exploit samples or the public PoC generators referenced in the advisory, and review email gateway logs for related attachments.
• Correlate endpoint telemetry for Office crashes or memory-corruption indicators followed by process creation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.