CVE-2017-0243 is a remote code execution vulnerability in Microsoft Office, affecting various Office products, Business Productivity Servers, and web applications. It stems from improper handling of objects in memory. With a CVSS score of 7.8 (HIGH), it has a low attack complexity and requires user interaction, but can lead to high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, its EPSS score indicates a higher than average likelihood of exploitation, and it has garnered some community discussion and media coverage, despite a lack of public exploit code.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:business_productivity_servers:2010:sp2:*:*:*:*:*:* | ||
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:web_applications:2010:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.