CVE-2014-2778

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

published June 11, 2014

CVSS
—
EPSS
20%
Percentile
97.4
In the wild
Unconfirmed
What it is

⚠️ This vulnerability lurks in Microsoft Word 2007 and the Compatibility Pack, waiting for a crafted embedded font to trigger chaos! 📄✨ Think of it like a recipe card with a sneaky typo — when the chef reads it wrong, the whole dish can go horribly wrong! In this case, an attacker can use a corrupted font to create a .doc or .docx that leads to memory corruption. An attacker could remotely execute arbitrary code on a victim's machine or even cause a denial of service — imagine your computer freezing mid-presentation, leaving you staring at a blank screen in horror! That's absolutely devastating.

Put simply

Think of it like a recipe card with a sneaky typo — when the chef reads it wrong, the whole dish can go horribly wrong! In this case, an attacker can use a corrupted font to create a .doc or .docx that leads to memory corruption. This vulnerability allows remote code execution or denial of service through specially crafted embedded fonts in Microsoft Word documents, exploiting flaws in memory handling.

What to do

An attacker could remotely execute arbitrary code on a victim's machine or even cause a denial of service — imagine your computer freezing mid-presentation, leaving you staring at a blank screen in horror! That's absolutely devastating. To protect yourself, consider upgrading to a newer version of Word or applying any available security patches. Additionally, avoid opening documents from untrusted sources, as these can contain malicious fonts. You've got this! Stay vigilant, and together, we can keep your systems secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.19923 · 97.4th percentile
Published
2014-06-11T01:00Z
EPSS history
Timeline
  • 11 JUN 01:00Z
    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
    cvelistv5