CVE-2017-0199: Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Mic...

Security readout for executives and security teams

CVE-2017-0199 lets an attacker run code when a user opens a specially crafted document in affected Microsoft Office or WordPad environments. The main business risk is document-based compromise of endpoints, typically through phishing or malicious attachments. CISA KEV marks it as known exploited, so legacy or unpatched systems should be treated as urgent exposure. Exposure is most likely on endpoints or servers with affected Office/WordPad components that process untrusted documents. Organizations retaining older Windows or Office versions face the highest risk, especially where email attachments, downloaded RTF/Office files, or document preview workflows reach users. Treat this as high priority where legacy Microsoft Office or Windows systems remain in use. The vulnerability is old but known exploited, document-delivered, and capable of full system compromise after user interaction. Focus first on patch verification, legacy asset reduction, and attachment controls. Mitigation focus: Check Microsoft MSRC guidance for CVE-2017-0199 and apply relevant security updates.; Prioritize legacy Office and Windows assets named in the affected-product list.; Restrict opening of untrusted Office or RTF documents on exposed legacy systems..

Prepared

May 22, 2026, 05:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.