CVE-2017-0199

ENISA EUVD: EUVD-2017-0566 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 9 articles

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

94.3%

probability

This CVE has a 94.3% probability of being exploited in the next 30 days.

0% Top 99.9th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

7.8

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Project Zero

Logic/design flaw in embedded HTA documents

Affected Products

Google Project Zero

Patched

April 11, 2017

Reported by

Ryan Hanson (@Ryhanson) of Optiv, Microsoft MSRC Vulnerabilities and Mitigations Team, Microsoft Office Security Team, Genwei Jiang, FLARE Team, FireEye Inc, Eduardo Braun Prado of SecuriTeam Secure Disclosure (SSD)

Root Cause Analysis

???

Exploits & PoC

bhdresh/CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Mic

726

haibara3839/CVE-2017-0199-master

CVE-2017-0199

Exploit-install/CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate

jacobsoo/RTF-Cleaner

RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759

nicpenning/RTF-Cleaner

RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.

kn0wm4d/htattack

An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)

mzakyz666/PoC-CVE-2017-0199

Exploit toolkit for vulnerability RCE Microsoft RTF

n1shant-sinha/CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate

8 repos — triés par ⭐ Rechercher sur GitHub ↗

Recent Microsoft 0-Day Used for Cyber-Espionage and Mundane Malware Distribution

BleepingComputer Apr 13, 2017

Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition)

Qualys Jul 18, 2023

Microsoft Fixes 45 Vulnerabilities with new Security Update Guide – says goodbye to Security Bulletins

Qualys Apr 11, 2017

Qualys Top 20 Most Exploited Vulnerabilities

Qualys Sep 04, 2023

Microsoft Office Zero-Day Used to Push Dridex Banking Trojan

BleepingComputer Apr 11, 2017

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Security Advisory 2017-009

CERT-EU Apr 12, 2017

New Malware Campaign Targeting Job Seekers with Cobalt Strike Beacons

TheHackerNews

Cybercriminals Use Excel Exploit to Spread Fileless Remcos RAT Malware

TheHackerNews

Signal Intelligence

Confidenceⓘ

92%

EPSS 94.3%

CVSS v3.1 7.8

Mentions 9

Last Seen May 27, 2026

CNA Information

Analyst Note

CVE-2017-0199 is a well-documented remote code execution vulnerability in Microsoft Office affecting multiple versions across Windows platforms, with CVSS 7.8 (HIGH) severity. The vulnerability was reported by Google Project Zero and actively exploited in the wild according to CERT-EU security advisories, providing strong evidence for confirmation.