CVE-2017-8570
Microsoft Office Remote Code Execution Vulnerability
Description
CVE-2017-8570 is a HIGH severity remote code execution vulnerability in Microsoft Office 2007, 2010, 2013, and 2016 that occurs when the software fails to properly handle objects in memory. The flaw allows an attacker to execute arbitrary code in the context of the current user by convincing a victim to open a specially crafted Office file, typically delivered through phishing emails or malicious websites. With a CVSS 3.1 score of 7.8 and an EPSS score of 0.94247 (99.9th percentile), this vulnerability demonstrates near-certain exploitation activity in the wild. CVE-2017-8570 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 25, 2022, though it is not currently associated with known ransomware campaigns. The vulnerability is closely related to the well-known CVE-2017-0199 and exploits a similar OLE object handling mechanism.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2007; 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/99445(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/ParsingTeam/ppsx-file-generator(Exploit, Third Party Advisory)
- https://github.com/rxwx/CVE-2017-8570(Third Party Advisory)
- https://github.com/tezukanice/Office8570(Exploit, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8570(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8570(US Government Resource)
Weakness Type
Improper Handling of Objects in Memory
Improper handling of objects in memory is a broad vulnerability class that encompasses multiple memory safety issues including use-after-free conditions, type confusion, and incorrect object lifecycle management. When software fails to properly manage object references, allocation, and deallocation in memory, attackers can manipulate these inconsistencies to corrupt memory structures and achieve arbitrary code execution. In the context of complex document-processing applications like Microsoft Office, this class of weakness is particularly prevalent because the software must parse numerous embedded object types (OLE objects, ActiveX controls, scripts) from untrusted documents.
In CVE-2017-8570, Microsoft Office improperly handles certain objects when processing Office documents, specifically through the Packager OLE object mechanism. This vulnerability is exploited through specially crafted files (commonly PPSX or PPTX format) that embed a malicious script moniker component. When the victim opens the document, Office instantiates the embedded object and triggers the malicious payload without requiring macros to be enabled. The attack leverages the composite moniker class to execute an embedded SCT (Windows Script Component) file, bypassing traditional macro-based security controls. Learn more about memory handling weaknesses at MITRE CWE resources.
Impact Analysis
CVE-2017-8570 carries a CVSS 3.1 score of 7.8 (HIGH) with an Unchanged scope, reflecting severe local impact when a user opens a malicious Office document.
Confidentiality (High): Successful exploitation executes arbitrary code with the privileges of the current user, granting the attacker access to all files, email, browser credentials, and network resources accessible to that user account. In enterprise environments where users often have access to shared drives, internal applications, and sensitive business data, the confidentiality impact of a single compromised workstation can be extensive. Attackers commonly use this initial access to harvest credentials and exfiltrate sensitive documents.
Integrity (High): With code execution in the user's context, an attacker can modify files, install persistent backdoors, alter system configurations, and deploy additional malware. The attack frequently serves as the initial access vector in multi-stage campaigns where the attacker subsequently installs remote access trojans (RATs), deploys keyloggers, or establishes command-and-control communications. If the compromised user has administrative privileges, the integrity impact extends to system-level modifications.
Availability (High): The attacker can disrupt the user's work environment by encrypting files, terminating processes, or consuming system resources. Code execution in the user context also enables deployment of destructive payloads that can render the workstation inoperable or propagate through the network to affect multiple systems.
Scope (Unchanged): The scope remains unchanged as the code execution occurs within the user's security context on the same system. However, the practical impact often extends beyond the initial host through lateral movement. With an EPSS score of 0.94247 at the 99.9th percentile, this vulnerability has one of the highest exploitation probabilities among all tracked CVEs, reflecting extremely widespread and active exploitation campaigns targeting Office users worldwide.
Exploit Maturity
Active Exploitation: CVE-2017-8570 has been extensively exploited in the wild since its disclosure in July 2017. The vulnerability is confirmed in CISA's KEV catalog as actively exploited and has been used in numerous targeted and commodity attack campaigns worldwide. Multiple threat intelligence reports document its use by both state-sponsored groups and cybercriminal organizations.
Ransomware Association: While CISA's KEV entry does not specifically flag ransomware association, the vulnerability has been observed in attack chains leading to various malware deployments. Its role as an initial access vector makes it a precursor to multiple final-stage payloads including ransomware, banking trojans, and remote access tools.
Public Exploits: Multiple public exploit implementations are available, including tools on GitHub such as the ppsx-file-generator by ParsingTeam and CVE-2017-8570 by rxwx. These tools significantly lower the barrier to exploitation by providing ready-made exploit generators. The widespread availability of exploit code has contributed to the vulnerability's extremely high EPSS score.
EPSS Context: The EPSS score of 0.94247 at the 99.9th percentile places this among the most actively exploited vulnerabilities in the entire CVE catalog. This extreme score reflects years of sustained exploitation activity across diverse threat actor groups and campaign types.
KEV Remediation Deadline: CISA set a remediation deadline of August 25, 2022. Organizations still running unpatched Office 2007, 2010, 2013, or 2016 installations are at critical risk given the trivial exploitability and widespread availability of attack tools.
Remediation
-
Apply the Microsoft July 2017 security update immediately. Install the patch from Microsoft's security advisory for CVE-2017-8570 to address the OLE object handling vulnerability in Office 2007, 2010, 2013, and 2016. Verify patch deployment across all Office installations using your organization's patch management system.
-
Upgrade to Microsoft 365 or Office 2019/2021 with automatic updates. Older Office versions (2007, 2010) have reached end of support and no longer receive security updates. Migrate to a currently supported Office version that receives ongoing security patches and includes modern security features such as Protected View and Application Guard for Office.
-
Ensure Protected View is enabled and not bypassed. Microsoft Office Protected View opens documents from untrusted sources in a sandboxed read-only mode that blocks exploitation. Verify through Group Policy that Protected View is enabled for files downloaded from the internet, received as email attachments, and opened from unsafe locations. Educate users to never click "Enable Editing" on unexpected documents.
-
Implement email attachment filtering and sandboxing. Deploy email security solutions that scan Office document attachments for embedded OLE objects, script monikers, and other exploit indicators. Configure attachment sandboxing to detonate suspicious documents in isolated environments before delivery to end users.
-
Deploy Attack Surface Reduction (ASR) rules via Microsoft Defender. Enable ASR rules that block Office applications from creating child processes, creating executable content, and injecting code into other processes. These rules specifically mitigate exploitation techniques used by CVE-2017-8570 and similar Office document exploits.
-
Conduct user awareness training on document-based attacks. Train users to recognize phishing attempts delivering malicious Office documents, understand the risks of enabling editing or macros in untrusted documents, and report suspicious attachments to the security team. Regular phishing simulations help maintain awareness and reduce the likelihood of successful social engineering.
Technical Details
CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office that exploits improper handling of OLE (Object Linking and Embedding) objects during document processing. The vulnerability specifically targets the Packager OLE mechanism and the composite moniker class to achieve code execution without requiring macro activation.
The attack typically uses a crafted PowerPoint file (PPSX/PPTX format) that embeds a Script Moniker object referencing a Windows Script Component (SCT) file. When the victim opens the presentation, Office processes the embedded OLE object and the moniker resolution mechanism triggers execution of the referenced script without displaying a security warning or requiring user consent beyond opening the file. This bypass of macro security controls makes the vulnerability particularly dangerous.
The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies the attack vector as local because the victim must open a malicious file on their system. The attack complexity is low since no additional conditions beyond file opening are required. User interaction is required (the victim must open the document), but no privileges are needed by the attacker. The resulting code execution provides high impact across confidentiality, integrity, and availability within the user's security context.
The root cause lies in Office's failure to properly validate and restrict the types of OLE objects and moniker references that can be instantiated from within documents. The composite moniker mechanism allows chaining of object references in ways that the developers did not anticipate, enabling script execution through seemingly benign document elements. Microsoft's patch addresses this by adding proper validation of moniker types and restricting the execution of script components through OLE embedding.
Frequently Asked Questions
What is CVE-2017-8570?
CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office 2007, 2010, 2013, and 2016 that allows attackers to execute arbitrary code when a victim opens a specially crafted Office document. The vulnerability exploits improper handling of OLE objects, specifically through the Packager OLE and composite moniker mechanisms. Unlike macro-based attacks, this exploit does not require the user to enable macros, making it particularly effective in phishing campaigns.
How is CVE-2017-8570 exploited?
Attackers create specially crafted Office documents, typically PowerPoint files (PPSX/PPTX), that embed malicious OLE objects using the script moniker mechanism. When the victim opens the document, the embedded script component executes automatically without macro warnings. The exploit is commonly delivered through spear-phishing emails with malicious attachments. Public exploit generators are available on GitHub, making this vulnerability accessible to both sophisticated and less skilled threat actors.
How severe is CVE-2017-8570?
CVE-2017-8570 is rated HIGH with a CVSS 3.1 score of 7.8 and has an EPSS score of 0.94247 at the 99.9th percentile, placing it among the most actively exploited vulnerabilities in the entire CVE catalog. It is listed in CISA's KEV catalog confirming widespread active exploitation. The combination of trivial exploitability, public exploit tools, and effective delivery through phishing makes this one of the most dangerous Office vulnerabilities for enterprise environments.
How do I protect against CVE-2017-8570?
Apply the Microsoft July 2017 security update for all affected Office versions. Upgrade from end-of-life Office versions (2007, 2010) to currently supported releases. Ensure Protected View is enabled via Group Policy to sandbox untrusted documents. Deploy email attachment filtering and sandboxing to catch malicious documents before delivery. Enable Attack Surface Reduction rules in Microsoft Defender to block Office applications from spawning child processes or creating executable content.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.