{"id":"CVE-2016-7193","published":"2016-10-14T02:59:38Z","modified":"2026-06-17T00:52:45Z","title":"Microsoft Office Memory Corruption Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka \"Microsoft Office Memory Corruption Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in Microsoft Office components, including Word 2007 SP2, Office 2010 SP2, Word 2013, Word 2016, Word for Mac, Word Viewer, and several SharePoint and Office Web Apps Server products, is caused by improper restriction of operations within the bounds of a memory buffer. An attacker can execute arbitrary code by delivering a crafted RTF document, which requires the victim to open the document (user interaction) and is not limited by any authentication requirement.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:23Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.57582,"percentile":0.99079,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7193","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-10-11","exploitedFirstSeen":"2016-10-11","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2016-Oct","date":"2016-10-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-10-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/93372","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036984","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-121","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/93372","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036984","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-121","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7193","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: User opens crafted RTF document","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code via a crafted RTF document","start":364,"end":439}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution achieved","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code via a crafted RTF document","start":364,"end":439}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-8058","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-8058","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-10-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2016-Oct","provenance":"source"},{"date":"2016-10-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7193","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-8058","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1966},"priority":{"score":63.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3670 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9908"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-119"}}