What We Do
How We Do
Get Started
Security advisories

Microsoft Word RCE Vulnerability POC Released

March 7, 2023 | 2 MINS READ

Speak With A Security Expert Now



On March 6th, the eSentire Threat Intelligence team reviewed notable public reports and became aware of a Proof-of-Concept (PoC) exploit code release for CVE-2023-21716. The release also includes a technical write-up of the recently disclosed Microsoft Word vulnerability CVE-2023-21716 (CVSS: 9.8). The vulnerability was initially announced with the February 14th Microsoft February Patch Tuesday release. The write up was released on March 5th on Twitter and updated the POC in the report. CVE-2023-21716 is a vulnerability within Microsoft Office's wwlib, which allows attackers to achieve remote code execution via heap corruption. The vulnerability exists in the RTF parser in Microsoft Word and can be triggered by a malicious RTF document. It is notable that the preview pane for Microsoft word documents is an attack vector and will execute the payload simply by loading the preview.

What we’re doing about it

What you should do about it

Additional information

Threat actors can often rapidly weaponize vulnerabilities due to the public release of technical details and functional Proof-of-Concept (PoC) exploit code. As PoC exploit code is publicly available, it is almost certain that multiple threat actors’ groups are already exploiting the vulnerability for various purposes.

Currently, there are no reported real-world attacks involving the exploitation of this vulnerability. However, threat actors are likely to migrate from Macros, ISO mounting, and OneNote delivery to corrupted “.rtf” files to gain initial access to victim organizations.

This vulnerability impacts at least the following versions of Microsoft Office:

Older versions may also be impacted but were not tested. Furthermore, the technical details of this vulnerability have evolved over the years.

Will Dormann identified on March 7th that even after the patch is applied, the malicious payloads still crash a fully patched Microsoft Word on Mac OS; however, remote code execution appears to be no longer possible.

It is recommended to enable Protected View on Microsoft Office 2010 and later versions to limit the damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests; thus, an additional sandbox escape vulnerability would be required to gain full privileges.

Removing the file association for the RTF extension is ineffective because using a DOC extension will still reach the vulnerable code.


[1] https://qoop.org/publications/cve-2023-21716-rtf-fonttbl.md
[2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
[3] https://www.heise.de/news/Kritische-Word-Luecke-Proof-of-Concept-Code-veroeffentlicht-7537267.html
[4] Nessus Plugin ID 171554

View Most Recent Advisories