MSHTML Engine Remote Code Execution Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
As interim measures, administrators should disable ActiveX controls in Internet Explorer and Office applications where not strictly necessary, and enforce strict email and web filtering to block malicious content. Implement robust endpoint detection and response (EDR) to monitor for unusual process execution originating from Office or browser contexts. User awareness training on identifying and avoiding suspicious links or attachments is also critical.
The permanent resolution is to apply the latest security updates provided by Microsoft for all affected products. This vulnerability impacts Microsoft Office, Office Word Viewer, Internet Explorer 9, 10, 11, Microsoft Excel Viewer, and Office 365 ProPlus. Ensure all listed applications are updated to their patched versions to remediate the input validation flaw in the MSHTML engine.
An attacker can exploit this vulnerability to achieve remote code execution on a victim's system, typically by enticing them to open a specially crafted file or visit a malicious website. This allows the attacker to run arbitrary code in the context of the current user, potentially leading to full system compromise, data theft, or further network penetration. Business consequences include significant data breaches, operational disruption, and reputational damage.
Other CVEs affecting excel viewer
Microsoft Outlook Elevation of Privilege Vulnerability
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
Internet Explorer Memory Corruption Vulnerability
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".