Security readout for executives and security teams
Plain-English summary
A crafted XPS document can crash STDU Viewer 1.6.375 and may have other unspecified impact. The sources do not provide a CVSS score, patch details, or confirmed exploitation. Business urgency depends on whether the viewer is still installed and used to open external .xps files.
Executive priority
Treat this as a targeted hygiene issue, not an enterprise emergency, unless STDU Viewer is broadly deployed or used with external documents. Prioritize discovery and removal or vendor-confirmed update guidance.
Technical view
The CVE describes possible stack corruption triggered when STDU Viewer 1.6.375 processes a crafted .xps file. The stated impact is denial of service, with possible unspecified other impact, but no confirmed code execution in the provided sources.
Likely exposure
Likely exposure is limited to endpoints where STDU Viewer 1.6.375 is installed and users can open untrusted .xps files. The source bundle does not identify broader product versions, server exposure, or affected CPEs.
Exploitation context
The CVE has a public advisory reference, but the source bundle does not show active exploitation and KEV status is false. Available evidence supports a malicious-file handling risk, not remote unauthenticated exploitation.
Researcher notes
Evidence is sparse. The CVE description points to crafted .xps parsing and possible stack corruption, but provides no CVSS, CWE, confirmed exploitability beyond denial of service, or named fix. Avoid assuming RCE without additional vendor or researcher evidence.
Mitigation direction
- Inventory endpoints for STDU Viewer 1.6.375 installations.
- Check vendor or maintainer guidance for fixed versions or retirement advice.
- Restrict opening .xps files from untrusted sources.
- Remove STDU Viewer where there is no business need.
- Use standard endpoint controls to quarantine suspicious document attachments.
Validation and detection
- Confirm whether STDU Viewer 1.6.375 exists in software inventory.
- Review email and web download paths for .xps file exposure.
- Check endpoint telemetry for STDU Viewer crashes tied to XPS files.
- Verify users with the viewer have a current business requirement.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14565 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14565CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.