CVE-2017-0199

This vulnerability is like a “dangerous file” trick: attackers can make a Word/Office document that, when opened, can cause the computer to run attacker code. Since it’s been used in ransomware campaigns, it’s one of those issues where outdated Office/Windows can become an entry point for full compromise.

This matters if you run Microsoft Office/WordPad or the listed Windows versions (including Windows 7, Windows Vista Service Pack 2, Windows 8.1, and certain Windows Server versions) on endpoints or servers used by your staff. Because the threat relies on remote attackers getting a crafted document to a vulnerable system, it’s most concerning when users can receive and open external Office/Word documents and systems are not fully patched. It’s a risk only if it’s reachable through document handling (and the relevant Office/WordPad and OS version is affected and not updated).

This is urgent because CISA has confirmed CVE-2017-0199 is being used in real ransomware campaigns (listed in CISA KEV). Public exploits exist, and active exploitation has been reported with sustained attention, so waiting increases your chance of becoming the next victim via a malicious document.