Microsoft Office 2007 SP3

CVE-2017-0199 is a logic flaw in how Microsoft Office and WordPad handle OLE2 linked objects embedded in RTF and Word documents. A crafted document contains an OLE link to a remote HTA (HTML Application) file; when the victim opens the document, Office fetches the URL, the server responds with application/hta content-type, and mshta.exe executes the payload as the current user — no macro warning, no protected view prompt in unpatched configurations. Affected products span Office 2007 SP3, 2010 SP2, 2013 SP1, 2016, and Windows Vista SP2 / Server 2008 SP2 WordPad, plus .NET Framework variants patched in the same MS17-014/MS17-015/KB4014793 wave.

The vendor's original 7.8 HIGH rating dramatically understates operational reality. CVSS scored it AV:L / UI:R — treating email delivery as out of scope — but this bug was actively weaponized in the wild by FinSpy operators before the patch shipped, then immediately adopted by Dridex, Latentbot, Godzilla, Cerber, and virtually every phishing-driven APT (APT34, APT28, Silent Group) for the following three years. Nine years post-disclosure it still ranks in the EPSS 99.93rd percentile because unpatched Office endpoints keep resurfacing on M&A-acquired networks and OT jump hosts.

Why this verdict

• KEV + EPSS 99.93 override friction analysis. When CISA has listed a bug for four years and it still sits in the top 0.07% of exploitation probability, the theoretical friction (UI:R, AV:L) has been empirically defeated at scale.
• Delivery-vector reality. CVSS scored this local because the attacker doesn't reach the network stack directly, but every observed campaign delivers via email or web download — treat it as network-reachable in every risk model.
• Role multiplier: on a standard user workstation the outcome is user-context RCE plus credential access — HIGH. On a Tier-0 admin endpoint, jump host, or RDS server the chain ends in cached-credential theft and domain compromise — floor is CRITICAL because Office is by definition installed on admin workstations at >>10% of the installed base.
• Commodity toolchain integration. Metasploit, Cobalt Strike, and every phishing-as-a-service kit ships a builder. Skill floor is zero.
• Nine-year-old patch. Anything unpatched today is unmanaged, and unmanaged Office endpoints are exactly where initial-access brokers focus.

Why not higher?

There is no severity bucket above CRITICAL. The score is capped at 9.3 rather than 9.8+ only because UI:R remains a genuine gate — a hardened Protected View + ASR + email gateway stack does meaningfully reduce hit rate on managed fleets.

Why not lower?

Downgrading below CRITICAL would require ignoring KEV listing, EPSS 99.93, and nine years of continuous in-the-wild abuse. No plausible enterprise deployment story justifies treating this as HIGH or below.

1. Deploy Microsoft ASR rule Block Office from creating child processes — GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A in Block mode kills the winword.exe → mshta.exe transition that this exploit depends on. Deploy fleet-wide within 3 days per the noisgate CRITICAL mitigation SLA, via Intune, GPO Computer Config → Admin Templates → Windows Components → Microsoft Defender Antivirus → Attack Surface Reduction, or Defender for Endpoint policy.
2. Disable mshta.exe via AppLocker or WDAC — Block execution of %windir%\System32\mshta.exe and %windir%\SysWOW64\mshta.exe for all standard users. HTA is legacy and has near-zero legitimate enterprise use in 2026. Roll out within 3 days on a monitored/audit-first basis to catch legit dependencies.
3. Enforce Protected View for internet and attachment files — GPO Microsoft Office 2016 → Security Settings → Protected View — enable all three (internet files, unsafe locations, Outlook attachments). Ensure Mark-of-the-Web propagation is intact on SMB shares.
4. Block outbound HTTP/S from Office processes at the proxy — Egress rule matching winword.exe, excel.exe, powerpoint.exe, wordpad.exe outbound to any host not on an internal allowlist. Deploy at the endpoint (Windows Firewall + WFP) and at the network proxy.
5. Detonate all inbound RTF/DOC/DOCX at the email gateway — Turn on sandbox detonation in Proofpoint TAP / Mimecast Attachment Protect / Defender for Office 365 Safe Attachments with Dynamic Delivery disabled for RTF specifically.

Run on each Windows endpoint under local admin (or via Intune script / SCCM Compliance / Defender for Endpoint Advanced Hunting). Example invocation: powershell.exe -ExecutionPolicy Bypass -File Check-CVE-2017-0199.ps1. Emits VULNERABLE, PATCHED, or UNKNOWN on stdout and sets a matching exit code (2/0/1).

#Requires -Version 3.0
# Check-CVE-2017-0199.ps1
# Detects unpatched Microsoft Office installs vulnerable to CVE-2017-0199.
# Exit codes: 0=PATCHED, 1=UNKNOWN, 2=VULNERABLE

$ErrorActionPreference = 'SilentlyContinue'

# Minimum patched file versions for winword.exe per Office channel (April 2017 patch level)
$MinVersions = @{
    '12.0' = [Version]'12.0.6779.5000'   # Office 2007 SP3 + KB4015551
    '14.0' = [Version]'14.0.7182.5000'   # Office 2010 SP2 + KB3178703
    '15.0' = [Version]'15.0.4919.1002'   # Office 2013 SP1 + KB3178710
    '16.0' = [Version]'16.0.4600.1000'   # Office 2016 MSI + KB3178708
}

$found = $false
$vulnerable = $false
$details = @()

foreach ($ver in $MinVersions.Keys) {
    $regPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Office\$ver\Word\InstallRoot",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\$ver\Word\InstallRoot"
    )
    foreach ($rp in $regPaths) {
        $installRoot = (Get-ItemProperty -Path $rp -Name Path).Path
        if ($installRoot) {
            $winword = Join-Path $installRoot 'winword.exe'
            if (Test-Path $winword) {
                $found = $true
                $fv = [Version](Get-Item $winword).VersionInfo.FileVersion.Split(' ')[0]
                $min = $MinVersions[$ver]
                $status = if ($fv -lt $min) { $vulnerable = $true; 'VULNERABLE' } else { 'patched' }
                $details += "Office $ver -> winword.exe $fv (min $min) [$status]"
            }
        }
    }
}

# Click-to-Run modern Office: patched in build 16.0.7870+ (Apr 2017)
$c2r = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name VersionToReport).VersionToReport
if ($c2r) {
    $found = $true
    $fv = [Version]$c2r
    $min = [Version]'16.0.7870.2020'
    $status = if ($fv -lt $min) { $vulnerable = $true; 'VULNERABLE' } else { 'patched' }
    $details += "Office C2R -> $fv (min $min) [$status]"
}

if (-not $found) {
    Write-Output 'UNKNOWN - no Office install detected'
    exit 1
}

$details | ForEach-Object { Write-Output $_ }
if ($vulnerable) {
    Write-Output 'VULNERABLE'
    exit 2
} else {
    Write-Output 'PATCHED'
    exit 0
}

Sources

1. CISA KEV entry
2. NVD CVE-2017-0199
3. Microsoft MS17-014 advisory
4. FireEye original disclosure blog
5. Metasploit exploit module
6. bhdresh PoC repo
7. Microsoft ASR rules reference
8. FIRST EPSS lookup