CVE-2017-0194 is an information disclosure vulnerability affecting Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP2, allowing remote attackers to extract sensitive data from process memory using specially crafted Office documents. Rated Medium (CVSS 5.5), this vulnerability requires user interaction (UI:R) and local access (AV:L) for successful exploitation, leading to high confidentiality impact (C:H). Despite a high FAUCET Risk Score of 94/100 and an EPSS score indicating higher exploitability than most CVEs, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB. While it has received some community discussion and media coverage, it is not listed in the KEV catalog and is considered inactive.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2007CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:* | ||
2010CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:microsoft:office_compatibility_pack:*:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.