{"id":"CVE-2014-1761","published":"2014-03-25T13:24:01Z","modified":"2026-06-17T00:05:31Z","title":"Microsoft Word Memory Corruption Vulnerability","vendor":"Microsoft","product":"Word","tier":"core","eol":null,"description":{"text":"Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in Microsoft Word, present across multiple Word versions (including 2003 through 2013 and Word Viewer, among others), arises from improper bounds handling in how the software processes RTF data. An attacker can craft a malicious RTF document that, when opened by a user, can execute arbitrary code or cause a denial of service, requiring user interaction to trigger.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:06:13Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.77734,"percentile":0.99566,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-02-15","dueDate":"2022-08-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1761","provenance":"source"},"vulncheckKev":{"dateAdded":"2014-03-24","exploitedFirstSeen":"2014-03-24","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1761","date":"2014-03-24"},{"url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.07.11.Pitty_Tiger/Pitty_Tiger_Final_Report.pdf","date":"2014-07-11"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/targeted-attacks-on-french-company-exploit-multiple-word-vulnerabilities/","date":"2014-07-15"},{"url":"https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html","date":"2014-07-31"},{"url":"https://2014.zeronights.org/assets/files/slides/roaming_tiger_zeronights_2014.pdf","date":"2014-11-13"},{"url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_InceptionReport_EN_v12914.pdf","date":"2014-12-09"},{"url":"https://blog.paloaltonetworks.com/2014/12/proactive-prevention-revisited-cloud-atlas-inception-framework-campaigns/","date":"2014-12-18"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf","date":"2015-02-01"},{"url":"https://cyberwarzone.com/wp-content/uploads/2019/02/ReportGlobalThreatIntelligence.pdf","date":"2015-02-06"},{"url":"https://www.group-ib.com/brochures/gib-buhtrap-report.pdf","date":"2016-03-01"}],"evidenceTotal":20,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://technet.microsoft.com/security/advisory/2953095","tags":["Patch","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017","tags":["Patch","Vendor Advisory"]},{"url":"http://technet.microsoft.com/security/advisory/2953095","tags":["Patch","Vendor Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1761","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1569","name":"System Services","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: User opens malicious document file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"via crafted RTF data","start":374,"end":394}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory corruption enables code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary code or cause a denial of service","start":302,"end":353}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"CVE-2014-1761","start":112253,"end":112266},{"quote":"62\r\nCVE-2011-0611, 63\r\nCVE-2011-1823, 60, 61\r\nCVE-2012-0056, 60\r\nCVE-2012-0158, 62\r\nCVE-2012-0507, 57\r\nCVE-2012-1723, 56, 57, 58, 59\r\nCVE-2012-1889, 64\r\nCVE-2013-0074, 56\r\nCVE-2013-0422, 57, 59\r\nCVE-2013-1493, 56\r\nCVE-2013-2423, 56\r\nCVE-2013-2460, 56\r\nCVE-2013-2551, 56\r\nCVE-2013-3896, 56\r\nCVE-2014-1761,","start":261250,"end":261554}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-1835","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1835","exploited":true,"exploitedSince":"2022-02-15","provenance":"source"},"exploits":[{"id":32793,"url":"https://www.exploit-db.com/exploits/32793","title":"Microsoft Word - RTF Object Confusion (MS14-017) (Metasploit)","type":"local","platform":"windows","date":"2014-04-10","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2014-04-10"},"metasploit":[{"name":"MS14-017 Microsoft Word RTF Object Confusion","module":"exploit/windows/fileformat/ms14_017_rtf","type":"exploit","disclosureDate":"2014-04-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb"}],"first":{"date":"2014-04-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"},{"stage":"related","techniques":["T1190","T1569"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2014-03-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2014-1761","provenance":"source"},{"date":"2014-03-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1761","provenance":"source"},{"date":"2014-04-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2014-04-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb","provenance":"source"},{"date":"2022-02-15","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1835","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"Metasploit","daysToKev":2884},"priority":{"score":72.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4602 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9957"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}