Security readout for executives and security teams
Plain-English summary
A malicious XPS document can crash STDU Viewer 1.6.375 or potentially run attacker-controlled code. The business risk is user-driven document handling: exposure depends on whether this old viewer is installed and used to open untrusted .xps files.
Executive priority
Treat this as a targeted legacy-software exposure rather than a broad enterprise emergency. Prioritize discovery and removal or replacement where STDU Viewer 1.6.375 exists, especially on systems exposed to external documents.
Technical view
CVE-2017-14574 affects STDU Viewer 1.6.375 through crafted .xps file parsing. The CVE describes arbitrary code execution or denial of service, related to a user-mode write access violation at an unknown symbol. Sources provide no CVSS score, CWE, patch details, or affected-version range beyond 1.6.375.
Likely exposure
Exposure is limited to systems running STDU Viewer 1.6.375, particularly where users can receive or open XPS files from email, downloads, shared drives, or archives. The source bundle does not identify other affected versions or products.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation appears to require opening a crafted .xps file in the vulnerable viewer. Public detail is sparse, so exploitation maturity is unclear.
Researcher notes
The record is thin: no CVSS, CWE, vendor advisory, patch version, or proof of active exploitation is present in the supplied bundle. Analysis should stay anchored to STDU Viewer 1.6.375 and crafted XPS parsing unless additional primary sources are obtained.
Mitigation direction
- Inventory systems for STDU Viewer 1.6.375 installations.
- Remove STDU Viewer where it is not business-required.
- Restrict opening untrusted .xps files with STDU Viewer.
- Check vendor or advisory guidance for fixed versions or retirement status.
- Use endpoint controls to limit risky document-handler execution.
Validation and detection
- Confirm whether STDU Viewer 1.6.375 exists in software inventory.
- Review default file associations for .xps files.
- Check whether users receive or exchange XPS documents.
- Look for endpoint alerts involving STDU Viewer crashes.
- Verify any vendor-recommended upgrade or removal action was completed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14574 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14574CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.