{
  "cveId": "CVE-2017-0262",
  "url": "https://patchblox.com/security/cve/CVE-2017-0262",
  "summary": "CVE-2017-0262 is fixed in 7 products on 1 platform, first by KB3118310, released May 10, 2017. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on February 10, 2022. Patch Radar priority: Patch now.",
  "title": "Microsoft Office Remote Code Execution Vulnerability",
  "description": "\u003Cp\u003EA remote code execution vulnerability exists in Microsoft Office that could be exploited when a user opens a file containing a malformed graphics image or when a user inserts a malformed graphics image into an Office file. Such a file could also be included in an email attachment. An attacker could exploit the vulnerability by constructing a specially crafted EPS file that could allow remote code execution. An attacker who successfully exploited this vulnerability could take control of the affected system.\u003C/p\u003E\n\u003Cp\u003EThis vulnerability could not be exploited automatically through a Web-based attack scenario. An attacker could host a specially crafted website containing an Office file that is designed to exploit the vulnerability, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an instant messenger or email message that takes users to the attacker\u0027s website, or by getting them to open an attachment sent through email.\u003C/p\u003E\n\u003Cp\u003EWorkstations and terminal servers that have Microsoft Office installed are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.\u003C/p\u003E\n\u003Cp\u003EWhen this fix is published, Microsoft had received reports of limited targeted attacks using this vulnerability.\u003C/p\u003E",
  "published": "2017-05-10T07:00:00Z",
  "severity": "Important",
  "epss": 0.81005,
  "epssPercentile": 0.99633,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": true,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation More Likely",
  "kev": {
    "added": "2022-02-10T00:00:00Z",
    "due": "2022-08-10T00:00:00Z",
    "ransomware": false,
    "requiredAction": "Apply updates per vendor instructions."
  },
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0262",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2010 Service Pack 2 (32-bit editions)",
      "fixedVersion": "",
      "fix": "KB3118310",
      "url": "https://patchblox.com/security/fix/microsoft/kb3118310",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2010 Service Pack 2 (64-bit editions)",
      "fixedVersion": "",
      "fix": "KB3118310",
      "url": "https://patchblox.com/security/fix/microsoft/kb3118310",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2013 RT Service Pack 1",
      "fixedVersion": "",
      "fix": "KB3172458",
      "url": "https://patchblox.com/security/fix/microsoft/kb3172458",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2013 Service Pack 1 (32-bit editions)",
      "fixedVersion": "",
      "fix": "KB3172458",
      "url": "https://patchblox.com/security/fix/microsoft/kb3172458",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2013 Service Pack 1 (64-bit editions)",
      "fixedVersion": "",
      "fix": "KB3172458",
      "url": "https://patchblox.com/security/fix/microsoft/kb3172458",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2016 (32-bit edition)",
      "fixedVersion": "",
      "fix": "KB3114375",
      "url": "https://patchblox.com/security/fix/microsoft/kb3114375",
      "released": "2017-05-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Office 2016 (64-bit edition)",
      "fixedVersion": "",
      "fix": "KB3114375",
      "url": "https://patchblox.com/security/fix/microsoft/kb3114375",
      "released": "2017-05-10T07:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}