CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability

CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office that arises when the software fails to properly handle objects in memory. If an attacker can get a user to open a specially crafted Office file, the flaw can allow code to run in the context of that user. For IT and security teams this matters because Office is widely deployed on endpoints and is a common delivery path for initial access; successful exploitation can lead to further compromise of the workstation and the broader environment.

Public detail on exact mechanics and affected builds is limited to the vendor and CISA descriptions. Confirm all version, configuration, and patch specifics directly against the Microsoft advisory for this CVE before acting.

How it works

The vulnerability belongs to the class of memory-handling flaws in document-parsing applications. Microsoft Office processes complex file formats that contain many object types; when those objects are not validated or cleaned up correctly, an attacker-controlled file can corrupt memory in a way that redirects execution.

In practice an attacker crafts a malicious Office document and delivers it through email, a file share, a download link, or another channel that reaches the user. When the document is opened in a vulnerable Office installation, the flawed object handling can allow the attacker’s code to run with the privileges of the logged-on user. No further CWE classification or exploit-step detail is provided in the source material, so defenders should treat this as a classic Office RCE via malicious file and rely on the vendor advisory for any deeper technical notes.

Am I affected? How to find it in your systems

Microsoft Office is typically installed on Windows workstations, laptops, and some terminal servers or VDI images used by knowledge workers. Inventory every endpoint and image that has any Office application (Word, Excel, PowerPoint, Outlook, etc.) present.

• Use software inventory or endpoint-management tools to list installed Office products and their build/version strings.
• Compare those versions against the fixed builds listed in the Microsoft security advisory for CVE-2017-8570; do not assume any particular release is safe without that confirmation.
• Check whether users can open files from untrusted sources (email attachments, internet downloads, external USB media) and whether Protected View or similar sandboxing features are enabled.
• Review mail-gateway, endpoint-detection, and process-creation logs for unusual Office child processes, unexpected network connections originating from Office binaries, or repeated crashes of Office applications after opening documents—common telemetry signs of attempted exploitation of memory-corruption bugs in this class.

If your inventory tooling cannot reliably report Office build numbers, treat those systems as potentially affected until verified.

How to remediate

The primary remediation is to apply the security updates Microsoft released for this vulnerability. Follow the vendor instructions exactly: identify the correct update package for each Office edition and channel in use, deploy it through your normal patch-management process, and verify installation success.

• Prioritize internet-facing or high-privilege user workstations first, then the rest of the estate.
• After patching, confirm the new build numbers match the fixed versions published in the advisory.
• As hardening for this class of flaw, keep Office fully updated on a regular cadence, enforce Protected View for files originating from the internet or email, and disable unnecessary Office legacy features or macros where business needs allow.
• Ensure users operate with standard (non-admin) privileges so that any successful code execution is at least constrained.

If you can't patch immediately

When immediate patching is not possible, apply compensating controls that reduce the likelihood of a malicious document reaching a vulnerable parser or limit the impact of successful exploitation.

• Segment high-risk user populations and restrict outbound network access from their workstations so that post-exploitation callbacks are harder.
• Use mail and web gateways to block or sandbox Office attachments from untrusted senders; where available, enable detonation or content-disarm capabilities.
• Enforce Protected View and disable editing/macros by default for files from external sources.
• Deploy application-control or attack-surface-reduction rules that prevent Office applications from spawning child processes commonly used by exploit payloads (command shells, scripting hosts, etc.).
• Increase monitoring on Office process trees, unusual file writes, and credential-access attempts until the patch can be applied.

These measures do not eliminate the vulnerability; they only buy time. Schedule the official update as soon as operationally feasible.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities in desktop productivity software frequently serve as the entry point for broader incidents, including data theft. If you have evidence that a malicious Office document was opened on an unpatched system, follow your incident-response process: isolate the host, collect volatile evidence, and hunt for lateral movement or exfiltration. As a simple additional check, users can run a free exposure scan of their work email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.