CVE-2017-0261

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.

Affected

Microsoft Corporation · Microsoft Office

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

78.13% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-03-03

Published

2017-05-12

Updated

2025-10-21

Proof-of-concept exploits (2)

• erfze/CVE-2017-02610★ · 2020-08-22
• kcufId/eps-CVE-2017-026110★ · 2019-03-31

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261
• http://www.securityfocus.com/bid/98104
• http://www.securitytracker.com/id/1038444

References

• CVE Record
• NVD entry

Related

• CVE-2017-8570