CVE-2014-1761
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.777 · 100 %ileexploit · functionalEURUUSadded 2022-02-15remediate by 2022-08-15
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-27
Microsoft Word Memory Corruption Vulnerability
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.8–9.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- EDB-32793Microsoft Word - RTF Object Confusion (MS14-017) (Metasploit)functional · exploit_db
- exploit/windows/fileformat/ms14_017_rtfMS14-017 Microsoft Word RTF Object Confusionfunctional · metasploit
affected products (27)
Products and version ranges known to be affected.
- microsoft office compatibility packall versionsnvdUScpe:2.3:a:microsoft:office_compatibility_pack:*:*:*:*:*:*:*:*
- microsoft office web apps server= 2013nvdUScpe:2.3:a:microsoft:office_web_apps_server:*:*:*:*:*:*:*:*
also known as (10)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://secunia.com/advisories/57577cnnvd
- http://technet.microsoft.com/security/advisory/2953095cnnvd
- https://technet.microsoft.com/library/security/ms14-017Patchcnnvd
- http://technet.microsoft.com/security/advisory/2953095enisa_euvd
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017enisa_euvd
- http://technet.microsoft.com/security/advisory/2953095PatchVendor Advisorynvd
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017PatchVendor Advisorynvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1761US Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan