CVE-2014-1761KEV · OVERDUE

Microsoft Word Memory Corruption Vulnerability

High · published March 24, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

1530
days past CISA
deadline
CVSS v3.1
7.8
EPSS
78%
Percentile
99.6
In the wild
Confirmed
What it is

🚨 A single crafted RTF document can turn Microsoft Word into a hacker's playground! 🔥 Think of your computer as a restaurant kitchen. If a suspicious delivery arrives without proper checks, it could contain spoiled ingredients that jeopardize all the meals prepared—a recipe for disaster! In this case, a remote attacker could execute arbitrary code or cause a denial of service, potentially leading to complete system compromise or downtime—imagine the chaos when the kitchen is forced to close during peak hours. That's a hefty blow to operations and data integrity!

Put simply

Think of your computer as a restaurant kitchen. If a suspicious delivery arrives without proper checks, it could contain spoiled ingredients that jeopardize all the meals prepared—a recipe for disaster! This vulnerability in various versions of Microsoft Word allows attackers to exploit memory corruption through maliciously crafted RTF data, causing the application to behave unexpectedly or execute harmful commands.

What to do

In this case, a remote attacker could execute arbitrary code or cause a denial of service, potentially leading to complete system compromise or downtime—imagine the chaos when the kitchen is forced to close during peak hours. That's a hefty blow to operations and data integrity! To protect your systems, immediately update to the latest patches for Microsoft Word and related applications. Ensure that all users are educated on the risks of opening untrusted RTF files. Implement strict email and file handling policies to prevent these malicious deliveries. You've got this! By following these steps, you can keep your digital kitchen clean and secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.77734 · 99.6th percentile
Published
2014-03-24T19:00Z
KEV added
2022-02-15 · due 2022-08-15
EPSS history
Timeline
  • 15 FEB 00:00Z
    Added to CISA KEV — remediate by Aug 15
    kev
  • 24 MAR 19:00Z
    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation…
    cvelistv5