Microsoft Word Remote Code Execution Vulnerability CVE-2023-21716
Proof of Concept (PoC) code released for remote code execution vulnerability CVE-2023-21716 in Microsoft Word
Summary
Proof of Concept (PoC) code released for remote code execution vulnerability CVE-2023-21716 in Microsoft Word
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
A proof-of-concept (PoC) has been publicly released for a remote code execution (RCE) vulnerability in Microsoft Word, which has a CVSSv3.1 score of 9.8. An unauthenticated, remote attacker could embed malicious code in a crafted rich-text format (RTF) document which, when opened or previewed by a user running vulnerable software, would allow RCE with the privileges of the affected user. An attacker could deliver this file as an email attachment or by other means.
This PoC leads to a crash condition by corrupting the heap but does not allow code execution in its current form. With a properly crafted heap layout, an attacker could potentially cause the heap corruption to yield arbitrary code execution.
Although there is no known exploitation at present, a publicly available PoC can significantly increase the likelihood of exploitation in the wild.
Remediation advice
Affected organisations are highly encouraged to read the advisory for Microsoft Word Remote Code Execution Vulnerability CVE-2023-21716 and apply necessary security updates or workarounds.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 9 March 2023 12:24 pm