CVE-2017-0199

CVE-2017-0199 is a remote code execution vulnerability affecting multiple versions of Microsoft Office and Windows operating systems caused by the improper handling of OLE objects within crafted documents. With a High CVSS score of 7.8, this flaw allows remote attackers to execute arbitrary code if a user is tricked into opening a malicious file, resulting in a potential complete compromise of system confidentiality, integrity, and availability. The vulnerability poses a critical risk and is actively exploited in the wild by advanced persistent threat (APT) groups, such as BlueNoroff and Gamaredon, to deploy payloads like Cobalt Strike and FormBook. Public exploit code is widely available through frameworks like Metasploit, and the flaw remains a significant threat in current attack landscapes, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities catalog and ongoing reports of its use in 2025.