CVE-2016-7193 vulnerability in Microsoft Products
Published on October 14, 2016

Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Microsoft Office Memory Corruption Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.

The following remediation steps are recommended / required by March 24, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2016-7193 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is a Buffer Overflow Vulnerability?

The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

CVE-2016-7193 has been classified to as a Buffer Overflow vulnerability or weakness.

Products Associated with CVE-2016-7193

You can be notified by stack.watch whenever vulnerabilities like CVE-2016-7193 are published in these products:

Microsoft Word Viewer

Microsoft Word

Microsoft Office

Microsoft Office Compatibility Pack

What versions are vulnerable to CVE-2016-7193?