Security readout for executives and security teams
Plain-English summary
A malicious Word document could bypass Word’s macro security and run attacker-controlled macros automatically. The issue affects legacy Microsoft Word versions named in the CVE description. Business risk is highest where old Office installations can still open untrusted documents from email, web downloads, or archives.
Executive priority
Prioritize if legacy Office remains in production or reachable through document workflows. If those versions are absent, treat as a historical tracking item and document non-exposure.
Technical view
CVE-2003-0664 is improper checking of certain Word document properties in Microsoft Word 2002, 2000, 97, and 98(J). The flaw can bypass the macro security model and automatically execute arbitrary macros when a malicious document is processed.
Likely exposure
Exposure is likely limited to organizations retaining very old Microsoft Word versions or legacy systems that open historical Office documents. Modern Office versions are not identified as affected in the supplied sources.
Exploitation context
The provided sources describe a malicious-document attack path but do not show CISA KEV listing or cited evidence of active exploitation. No exploit status should be assumed from this bundle.
Researcher notes
The bundle lacks CVSS, CWE, detailed affected CPEs, and explicit exploit telemetry. Analysis is based on the CVE description, OVAL reference, and Microsoft bulletin reference only.
Mitigation direction
- Review Microsoft MS03-035 and apply applicable vendor remediation for affected Word versions.
- Retire or isolate systems still running Word 2002, 2000, 97, or 98(J).
- Restrict opening untrusted Word documents on legacy Office systems until remediated.
- Use mail and web filtering to quarantine suspicious legacy Word documents.
Validation and detection
- Inventory endpoints for Microsoft Word 2002, 2000, 97, and 98(J).
- Check applicable systems against OVAL definition oval:org.mitre.oval:def:188.
- Confirm whether Microsoft MS03-035 remediation is installed or otherwise addressed.
- Review document-ingress controls for users operating affected legacy Word versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2003-0664 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- oval:org.mitre.oval:def:188CVE reference · vdb-entry, signature
- MS03-035CVE reference · vendor-advisory, x_refsource_MS
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.