CVE-2017-0199
KEV RANSOMWAREHIGH 9.3EPSS 99.9%
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
- CVSS v3.1
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0
- 9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 99.93% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Published
- 2017-04-12
- Updated
- 2025-10-21
Proof-of-concept exploits (24)
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
- BRAINIAC22/CVE-2017-01990★ · 2022-04-22
- Exploit-install/CVE-2017-01997★ · 2017-04-22
- Mal-lol-git/URL-Parser1★ · 2020-11-04
- Nacromencer/cve2017-0199-in-python0★ · 2020-08-25
- Phantomlancer123/CVE-2017-01991★ · 2022-04-20
- Sunqiz/CVE-2017-0199-reprofuction2★ · 2022-08-19
- SyFi/cve-2017-019912★ · 2017-04-13
- TheCyberWatchers/CVE-2017-0199-v5.00★ · 2023-09-02
- Winter3un/cve_2017_01990★ · 2017-10-29
- bhdresh/CVE-2017-0199724★ · 2017-11-19
- bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-01992★ · 2017-11-17
- haibara3839/CVE-2017-0199-master16★ · 2017-04-19
- herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-01992★ · 2017-11-17
- kash-123/CVE-2017-01990★ · 2025-12-10
- kn0wm4d/htattack2★ · 2017-04-24
- likekabin/CVE-2017-01990★ · 2018-03-22
- likescam/CVE-2017-01990★ · 2018-03-22
- mzakyz666/PoC-CVE-2017-01992★ · 2017-04-22
- n1shant-sinha/CVE-2017-01992★ · 2017-04-23
- ryhanson/CVE-2017-01990★ · 2017-04-13
- sUbc0ol/Microsoft-Word-CVE-2017-0199-0★ · 2017-06-30
- stealth-ronin/CVE-2017-0199-PY-KIT0★ · 2020-10-18
- viethdgit/CVE-2017-01990★ · 2017-09-19
Metasploit modules (1)
ExploitDB entries (3)
- https://www.exploit-db.com/exploits/41934
- https://www.exploit-db.com/exploits/42995
- https://www.exploit-db.com/exploits/41894