Microsoft Word Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 28/03/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| office web apps | = 2010 | |
| sharepoint server | = 2010 | |
| word | = 2003= 2007= 2010 |
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free