CVE-2017-0199
KEV RANSOMWAREHIGH 7.8EPSS 99.5%
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
- Affected
- Microsoft Corporation · Office/WordPad
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 99.50% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Published
- 2017-04-12
- Updated
- 2025-10-21
Proof-of-concept exploits (24)
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
- BRAINIAC22/CVE-2017-01990★ · 2022-04-22
- Exploit-install/CVE-2017-01997★ · 2017-04-22
- Mal-lol-git/URL-Parser1★ · 2020-11-04
- Nacromencer/cve2017-0199-in-python0★ · 2020-08-25
- Phantomlancer123/CVE-2017-01991★ · 2022-04-20
- Sunqiz/CVE-2017-0199-reprofuction2★ · 2022-08-19
- SyFi/cve-2017-019912★ · 2017-04-13
- TheCyberWatchers/CVE-2017-0199-v5.00★ · 2023-09-02
- Winter3un/cve_2017_01990★ · 2017-10-29
- bhdresh/CVE-2017-0199725★ · 2017-11-19
- bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-01992★ · 2017-11-17
- haibara3839/CVE-2017-0199-master16★ · 2017-04-19
- herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-01992★ · 2017-11-17
- kash-123/CVE-2017-01990★ · 2025-12-10
- kn0wm4d/htattack2★ · 2017-04-24
- likekabin/CVE-2017-01990★ · 2018-03-22
- likescam/CVE-2017-01990★ · 2018-03-22
- mzakyz666/PoC-CVE-2017-01992★ · 2017-04-22
- n1shant-sinha/CVE-2017-01992★ · 2017-04-23
- sUbc0ol/Microsoft-Word-CVE-2017-0199-0★ · 2017-06-30
- stealth-ronin/CVE-2017-0199-PY-KIT0★ · 2020-10-18
- viethdgit/CVE-2017-01990★ · 2017-09-19
- MrWaifu24/vet0★ · 2026-09-29
Metasploit modules (1)
ExploitDB entries (3)
- https://www.exploit-db.com/exploits/41934
- https://www.exploit-db.com/exploits/42995
- https://www.exploit-db.com/exploits/41894
Security advisories
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
- http://www.securityfocus.com/bid/97498
- http://www.securitytracker.com/id/1038224
- https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
- https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability