Skip to content
OpenAdvisories
High · 7.8 Known exploited · Ransomware Public exploit CVE-2017-0199 EUVD-2017-0566GHSA-mrf9-75pc-cjmm

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Window…

Published Apr 12, 2017 · Updated Oct 21, 2025 · Assigned by microsoft

Vendor: Microsoft Product: Office/WordPad

Description

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Affected products

VendorProductAffectedFixed
Microsoft Office/WordPad Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 3

GitHub 23 repositories · most starred shown

  • bhdresh/CVE-2017-0199 ★ 727 · Apr 17, 2017

    Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious …

  • haibara3839/CVE-2017-0199-master ★ 16 · Apr 19, 2017

    CVE-2017-0199

  • NotAwful/CVE-2017-0199-Fix ★ 13 · Apr 18, 2017

    Quick and dirty fix to OLE2 executing code via .hta

  • SyFi/cve-2017-0199 ★ 12 · Apr 13, 2017
  • Exploit-install/CVE-2017-0199 ★ 7 · Apr 22, 2017

    Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / me…

  • jacobsoo/RTF-Cleaner ★ 3 · Dec 8, 2017

    RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759

  • nicpenning/RTF-Cleaner ★ 2 · Nov 3, 2017

    RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.

  • kn0wm4d/htattack ★ 2 · Apr 24, 2017

    An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)

  • n1shant-sinha/CVE-2017-0199 ★ 2 · Apr 23, 2017

    Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / me…

  • mzakyz666/PoC-CVE-2017-0199 ★ 2 · Apr 22, 2017

    Exploit toolkit for vulnerability RCE Microsoft RTF

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References