CVE-2023-21716: Microsoft Word integer overflow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a 99.6th percentile EPSS score, makes this an urgent patch target despite the thin description.

What it is

CVE-2023-21716 is a critical remote code execution flaw in Microsoft Word, tied to an integer overflow (CWE-190). The record gives only a one-line description, so the exact parsing path and affected code are not detailed, but the CVSS vector indicates a network-reachable, no-authentication, no-interaction bug with full confidentiality, integrity and availability impact.

Impact

An attacker who can get a crafted document processed gains code execution in the context of the Word or affected Office/SharePoint service process, which can lead to full host compromise. Because the vector shows no privileges or user interaction required, the impact is not limited to a single victim opening a file.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N) per the CVSS vector, so a crafted document or request reaching Word, Office Online Server, Office Web Apps or SharePoint is the likely path. The record does not specify the exact entry point, so treat any document-processing endpoint as exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.823 (99.6th percentile), indicating strong predicted exploitation pressure. The only references are Microsoft patch advisories, so no public exploit or in-the-wild confirmation is stated in this record.

What to do

• Apply the Microsoft update for CVE-2023-21716 to Word, Office, Office Online Server, Office Web Apps and SharePoint as the first action.
• Prioritize internet-facing and document-processing services (Office Online Server, Office Web Apps, SharePoint) for patching ahead of end-user desktops.
• Block or sandbox untrusted documents at mail and web gateways, and disable automatic document preview/rendering where it is not needed.
• Run Office and SharePoint service accounts with least privilege and enable Protected View and ASR rules for Office child processes.
• Monitor Microsoft advisories for revised affected-version lists, since this record does not enumerate them.

Detection

• Hunt for Word, Office Online Server, Office Web Apps or SharePoint processes spawning unexpected child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on crashes or abnormal terminations of Word/Office document-processing services that correlate with recently received documents.
• Review gateway and SharePoint logs for documents from untrusted sources hitting preview or conversion pipelines, and flag repeated failures against the same sender or file.
• Track EPSS and vendor advisory updates for this CVE and re-scan exposed document-processing endpoints for missing patches.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.