CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability

CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad. It stems from the way these applications parse specially crafted files. Successful exploitation lets an attacker run code on the affected system, which matters because Office and WordPad are common on Windows endpoints and the flaw has been used in ransomware campaigns. Defenders should treat it as a high-priority item and confirm all version and patch details against the vendor advisory.

How it works

The CWE for this issue is not specified in the available record. Per the CISA summary, Microsoft Office and WordPad contain an unspecified vulnerability in how they handle specially crafted files. An attacker who can deliver such a file—typically through email, a download, or a shared document—can trigger the flaw when the user opens or previews it. This leads to remote code execution under the context of the logged-on user. Exact exploit mechanics are not detailed in the public summary; treat any observed file-based attack against these applications as potentially related and validate against the vendor advisory rather than assuming a specific technique.

Am I affected? How to find it in your systems

Microsoft Office and WordPad are standard components on most Windows workstations and many servers used for document processing. Inventory every system that has Office suites or the built-in WordPad binary installed. Check installed product versions and update levels against the list published in the Microsoft advisory for CVE-2017-0199; do not rely on generic version ranges because the precise affected builds are defined only by the vendor. Look for systems that still accept or automatically open untrusted Office or RTF-style documents. Telemetry signs of possible exploitation include unexpected process launches from Office or WordPad, unusual child processes, or network connections initiated shortly after a document is opened. Review mail-gateway and endpoint logs for specially crafted file attachments that match patterns described in the advisory. Confirm detection logic with the vendor’s guidance before declaring a system clean or compromised.

How to remediate

Apply the security updates Microsoft released for this vulnerability, following the vendor instructions exactly as stated in the advisory. CISA’s required action is to apply those updates. After patching, verify installation through your software inventory or configuration-management tools. Beyond the patch, harden the document-handling path: enforce Protected View for files from the internet, disable unnecessary Office features that parse untrusted content, and ensure users open documents only from trusted sources. Keep Office and the underlying Windows components on a regular patch cadence so similar parsing flaws are closed promptly.

If you can't patch immediately

Segment systems that must remain unpatched so they cannot reach critical assets. Use application allow-listing or attack-surface reduction rules to block Office and WordPad from spawning unexpected child processes. Deploy virtual patching or email/web gateway rules that quarantine or sandbox files matching the characteristics called out in the advisory. Disable WordPad where it is not required, and configure Office to open documents in restricted modes by default. Increase monitoring on endpoints for anomalous behavior tied to document applications, and alert on any execution that follows opening of an untrusted file. These controls reduce risk only until the official updates can be applied; they are not a substitute for the vendor patch.

If your data may have been exposed

Actively exploited vulnerabilities of this class have led to ransomware and broader breaches. If you suspect compromise, isolate affected hosts, preserve forensic evidence, and begin incident-response procedures. As a quick check for prior exposure of credentials or personal data, you can run a free exposure scan of your email addresses against known breach data sets.