IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High KEV

CVE-2017-0261Microsoft Office Use-After-Free Vulnerability

Microsoft Corporation Microsoft Office Published: (9 years ago)

Known exploited — Microsoft Office Use-After-Free Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 24.03.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-0261

Description

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.

Weakness (CWE): CWE-416

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
Microsoft Corporation Microsoft Office Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016
microsoft office 2010

References and patches

CPE matches (NVD) (3)
  • cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*

Recent CVEs in the same product — Microsoft Office / 365 Apps

8.8High
CVE-2026-120003

Microsoft Office Remote Code Execution Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

6.5Medium
CVE-2026-119999

Microsoft Office Excel Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

6.5Medium
CVE-2026-119998

Microsoft Office Security Feature Bypass Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Product ui does not warn user of unsafe actions in Microsoft Office allows an unauthorized attacker to bypass a security feature over a network.