CVE-2017-0262
Microsoft Office Remote Code Execution Vulnerability
Description
CVE-2017-0262 is a HIGH severity remote code execution vulnerability in Microsoft Office, carrying a CVSS 3.1 score of 7.8. The vulnerability allows an attacker to execute arbitrary code in the context of the current user by crafting a malicious Office document containing a specially prepared Encapsulated PostScript (EPS) image. Affected versions include Microsoft Office 2010, 2013, and 2016. Opening the malicious document triggers the vulnerability without requiring any further interaction from the user. This CVE was notably exploited by the APT28 (Fancy Bear) threat group in combination with CVE-2017-0263 (Win32k privilege escalation) to achieve full system compromise. It was added to CISA's KEV catalog on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 65.05% (98.45th percentile) reflects high exploitation likelihood.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98279(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0262(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0262(US Government Resource)
Weakness Type
EPS Image Processing Vulnerability
CVE-2017-0262 does not have a formally assigned CWE in the NVD database, but the underlying weakness relates to improper handling of Encapsulated PostScript (EPS) image content within Microsoft Office applications. The vulnerability exists in the EPS filter component used by Office to render PostScript graphics embedded in documents.
The EPS format, a legacy image format based on the PostScript language, supports complex scripting capabilities that can be abused to achieve code execution. Microsoft Office's EPS filter fails to properly validate and sandbox the processing of PostScript commands, allowing an attacker to craft EPS content that escapes the intended processing context and executes arbitrary code. This is a class of vulnerability that arises from processing complex, Turing-complete file formats without adequate input sanitization and sandboxing.
Impact Analysis
CVE-2017-0262 carries a CVSS 3.1 base score of 7.8 (HIGH) with full impact when combined with social engineering or spear-phishing delivery.
Confidentiality (High): Successful exploitation executes code in the context of the current user, granting access to all files, emails, credentials, and data accessible to that user. In typical enterprise environments where users access sensitive documents and network resources, the exposure can be extensive.
Integrity (High): The attacker can modify files, install malware, alter system configurations within the user's permission scope, and use the foothold to deploy additional attack tools. When combined with privilege escalation (CVE-2017-0263), the integrity impact extends to the entire system.
Availability (High): The attacker can crash applications, corrupt files, deploy ransomware (within user permissions), or use the initial access to disrupt broader system operations through privilege escalation.
Attack requirements: The vulnerability requires user interaction (UI:R) — the victim must open a malicious Office document. However, in targeted spear-phishing campaigns, this represents a realistic attack vector. No privileges are required on the target system beyond basic document opening capability.
With an EPSS score of 65.05% (98.45th percentile), this vulnerability carries significant exploitation probability, reflecting its use in sophisticated targeted campaigns.
Exploit Maturity
CVE-2017-0262 has a high exploit maturity with confirmed use in nation-state targeted attacks.
APT28 exploitation: This vulnerability was actively exploited by the APT28 (Fancy Bear) threat group in targeted spear-phishing campaigns. The attack delivered malicious Office documents containing crafted EPS images to high-value targets in government and political organizations.
Multi-stage attack chain: CVE-2017-0262 served as the initial access component in a sophisticated attack chain. After achieving code execution through the EPS vulnerability, the attackers deployed CVE-2017-0263 (Win32k privilege escalation) to gain kernel-level access and establish persistent control over compromised systems.
KEV listing: CISA added CVE-2017-0262 to the KEV catalog on February 10, 2022, confirming active exploitation with a remediation deadline of August 10, 2022.
Ransomware association: CISA's KEV does not indicate a direct ransomware association, though the vulnerability's use in sophisticated attack chains demonstrates its value as an initial access vector.
EPS filter history: Microsoft Office's EPS filter has been the target of multiple vulnerabilities. Following CVE-2017-0262 and related EPS flaws, Microsoft disabled the EPS filter in Office by default, acknowledging the systemic risk of processing PostScript content.
EPSS context: The EPSS score of 65.05% (98.45th percentile) places this well above the threshold for likely exploitation.
Remediation
-
Apply Microsoft security update immediately. Install the patch from the MSRC advisory for Microsoft Office 2010, 2013, and 2016. This update addresses the EPS filter vulnerability.
-
Disable the EPS filter in Microsoft Office. As a defense-in-depth measure, disable the EPS filter via registry settings or Group Policy. Microsoft eventually disabled this filter by default in later updates due to the systemic risk of EPS processing.
-
Address CVE-2017-0263 concurrently. Since attackers combined this vulnerability with CVE-2017-0263 for privilege escalation, ensure both are patched to break the complete attack chain.
-
Implement email attachment filtering. Configure email security gateways to scan and potentially block Office documents containing embedded EPS images. Consider blocking EPS files at the gateway level entirely.
-
Enable Protected View and Application Guard. Ensure Microsoft Office Protected View is enabled for documents from untrusted sources. Where available, deploy Office Application Guard to isolate document rendering in a sandboxed container.
-
Conduct spear-phishing awareness training. Given the APT delivery mechanism via crafted Office documents, provide targeted security awareness training focusing on the risks of opening unexpected document attachments, especially those with embedded graphics or unusual file characteristics.
Technical Details
CVE-2017-0262 is a remote code execution vulnerability in the Encapsulated PostScript (EPS) filter of Microsoft Office. The vulnerability exists because the EPS filter improperly handles PostScript content embedded in Office documents.
Attack vector and prerequisites: The attack is local (AV:L) from the CVSS perspective, requiring the victim to open a malicious file. Complexity is low (AC:L), no privileges are required (PR:N), and user interaction is required (UI:R) — opening the document. The attacker delivers a crafted Office document via email, file share, or web download.
Exploitation mechanism: The attacker creates a Microsoft Office document containing an embedded EPS image with malicious PostScript commands. When the victim opens the document, Office's EPS filter processes the PostScript content. The crafted PostScript exploits a vulnerability in the filter's parsing logic, allowing the execution of arbitrary code in the context of the Office process.
Payload delivery: In the APT28 campaigns, the EPS exploit delivered shellcode that downloaded and executed additional payloads, including the CVE-2017-0263 kernel exploit for privilege escalation. The initial shellcode ran with the permissions of the user who opened the document.
Affected products: Microsoft Office 2010, Office 2013, and Office 2016. The EPS filter is a shared component across these versions. Microsoft subsequently disabled the EPS filter by default in Office to mitigate this class of vulnerability.
CVSS vector analysis: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — the local vector with user interaction reflects the document-based delivery method typical of spear-phishing attacks.
Frequently Asked Questions
What is CVE-2017-0262?
CVE-2017-0262 is a high-severity remote code execution vulnerability in Microsoft Office's EPS (Encapsulated PostScript) filter. An attacker can craft a malicious Office document with an embedded EPS image that executes arbitrary code when the victim opens the document. It carries a CVSS score of 7.8 and affects Office 2010, 2013, and 2016.
How was CVE-2017-0262 used in real attacks?
CVE-2017-0262 was actively exploited by the APT28 (Fancy Bear) threat group in spear-phishing campaigns targeting government and political organizations. The attackers sent crafted Office documents via email, and combined this vulnerability with CVE-2017-0263 (Win32k privilege escalation) to achieve full system compromise.
How do I fix CVE-2017-0262?
Apply the Microsoft security update from the MSRC advisory. Disable the EPS filter in Office via registry or Group Policy as an additional precaution. Patch CVE-2017-0263 simultaneously to address the complete attack chain. Enable Protected View for documents from untrusted sources and implement email attachment filtering for EPS content.
How severe is CVE-2017-0262?
CVE-2017-0262 is rated HIGH with a CVSS score of 7.8. Its EPSS score of 65.05% places it in the 98.45th percentile. The confirmed use in APT28 nation-state attacks demonstrates its real-world severity. When chained with CVE-2017-0263, it enables complete system takeover from a single document opening.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.