CVE-2017-0199

high

Description

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

References

https://www.exploit-db.com/exploits/42995/

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

https://thehackernews.com/2025/09/ta558-uses-ai-generated-scripts-to.html

https://securelist.com/revengehotels-attacks-with-ai-and-venomrat-across-latin-america/117493/

https://securelist.com/vulnerabilities-and-exploits-in-q2-2025/117333/

https://securelist.com/vulnerabilities-and-exploits-in-q1-2025/116624/

https://www.darkreading.com/cyberattacks-data-breaches/sidewinder-apt-spying-indias-neighbor-govts

https://thehackernews.com/2025/05/south-asian-ministries-hit-by.html

https://www.acronis.com/en-us/cyber-protection-center/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/?__scribleNoAutoLoadToolbar=true

https://thehackernews.com/2025/03/clearfake-infects-9300-sites-uses-fake.html

https://securelist.com/vulnerabilities-and-exploits-in-q4-2024/115761/

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-stealthy-stalker-remcos-rat/

https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/

https://www.infosecurity-magazine.com/news/smokeloader-malware-taiwan/

https://www.fortinet.com/blog/threat-research/sophisticated-attack-targets-taiwan-with-smokeloader

https://thehackernews.com/2024/11/cybercriminals-use-excel-exploit-to.html

https://securityaffairs.com/170791/security/a-new-fileless-variant-of-remcos-rat-phishing.html

https://thehackernews.com/2024/10/free-sniper-dz-phishing-tools-fuel.html

https://securityonline.info/fileless-remcos-rat-campaign-leverages-cve-2017-0199-flaw

https://securelist.com/vulnerability-exploit-report-q2-2024/113455/

https://thehackernews.com/2024/08/multi-stage-valleyrat-targets-chinese.html

https://www.securityweek.com/indian-apt-targeting-mediterranean-ports-and-maritime-facilities/

https://thehackernews.com/2024/06/china-linked-valleyrat-malware.html

https://securelist.com/vulnerability-report-q1-2024/112554/

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a

https://web.archive.org/web/20211025233339/https://twitter.com/pancak3lullz/status/1452679527197560837

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-133a

https://www.mandiant.com/resources/blog/cve-2017-0199-hta-handler

https://www.exploit-db.com/exploits/41934/

https://www.exploit-db.com/exploits/41894/

https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/

https://us-cert.cisa.gov/ncas/alerts/aa21-200a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a

https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/

https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/

https://www.programmersought.com/article/62493896999/

https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf

https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf

https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies

https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/

https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/

https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/

https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report

https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf

https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/

https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html

https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf

https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/

https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/

https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets

https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf

https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/

https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target

https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts

https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf

http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries

https://securelist.com/the-dropping-elephant-actor/75328/

https://securelist.com/operation-daybreak/75100/

https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf

https://www.tenable.com/blog/aa23-215a-2022s-top-routinely-exploited-vulnerabilities

https://www.tenable.com/blog/analyzing-the-vulnerabilities-associated-with-the-top-malware-strains-of-2021

https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/

https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199

https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/

http://www.securitytracker.com/id/1038224

http://www.securityfocus.com/bid/97498

http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html

Details

Source: Mitre, NVD

Published: 2017-04-12

Updated: 2025-04-20

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.94366