T1203Execution

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit…

attack.mitre.org ↗

CVEs123

In 110

Reports7

Detections

35 Sigma rules tagged T1203

Exploitation for Client ExecutionT120335 general rules

Antivirus - Exploitation Framework Signaturecriticalstable
Droppers Exploiting CVE-2017-11882criticalstable
Audit CVE Eventcriticaltest
CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
Exploit for CVE-2017-8759criticaltest
Antivirus - APT Malware Signaturecriticalexperimental
Antivirus - Remote Access Tools Signaturecriticalexperimental

All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Exploitation for Client Execution

123 CVEs, by priority. Each link shows its badge.

CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Microsoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution15 reports
AI mapping from the description · primary impact
>99.9%Top 0.02%
89.2priority
CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution5 reports
MITRE CTID mapping of the CVE · uncategorised
94.9%Top 0.14%
89.1priority
CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution12 reports
AI mapping from the description · primary impact
99.5%Top 0.06%
88.4priority
CVE-2018-0802Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution8 reports
AI mapping from the description · primary impact
93.3%Top 0.17%
88.4priority
CVE-2015-1641Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution4 reports
MITRE CTID mapping of the CVE · uncategorised
97.2%Top 0.1%
87.4priority
CVE-2021-40444Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft · MSHTMLKEVRansomwarePublic exploitHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution3 reports
AI mapping from the description · primary impact
97.8%Top 0.09%
86.9priority
CVE-2011-3402Microsoft Windows Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
78.1%Top 0.42%
79.1priority
CVE-2016-7201Microsoft Edge Memory Corruption Vulnerability
Microsoft · EdgeKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more
AI mapping from the description · primary impact
80.0%Top 0.39%
79.1priority
CVE-2018-0798Microsoft Office Memory Corruption Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution5 reports
MITRE CTID mapping of the CVE · uncategorised
95.1%Top 0.14%
79.1priority
CVE-2010-3333Microsoft Office Stack-based Buffer Overflow Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client Execution T1204.002Malicious File5 reports
MITRE CTID mapping of the CVE · uncategorised
89.4%Top 0.22%
78.4priority
CVE-2017-8570Microsoft Office Remote Code Execution Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client Execution T1204.002Malicious File5 reports
MITRE CTID mapping of the CVE · uncategorised
89.9%Top 0.21%
78.4priority
CVE-2014-0515Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution2 reports
AI mapping from the description · primary impact
94.5%Top 0.15%
78.2priority
CVE-2015-3105Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution+1 more · 2 reports
AI mapping from the description · primary impact
90.1%Top 0.2%
77.9priority
CVE-2026-85046Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
1.8%Top 21%
74.9priority
CVE-2014-6352Microsoft Windows Code Injection Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.8T1203Exploitation for Client Execution T1204.002Malicious File2 reports
MITRE CTID mapping of the CVE · uncategorised
77.5%Top 0.44%
74.5priority
CVE-2015-2545Microsoft Office Malformed EPS File Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution2 reports
AI mapping from the description · primary impact
85.9%Top 0.27%
74.5priority
CVE-2022-2294WebRTC Heap Buffer Overflow Vulnerability
WebRTC · WebRTCKEVRansomwareHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
70.8%Top 0.6%
74.0priority
CVE-2025-14174Google Chromium Out of Bounds Memory Access Vulnerability
Google · ChromiumKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
55.3%Top 0.97%
74.0priority
CVE-2022-0609Google Chromium Animation Use-After-Free Vulnerability
Google · Chromium AnimationKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
22.4%Top 2.3%
73.7priority
CVE-2026-5281Google Dawn Use-After-Free Vulnerability
Google · DawnKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
13.7%Top 3.5%
73.5priority
CVE-2020-9715Adobe Acrobat Use-After-Free Vulnerability
Adobe · AcrobatKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution
AI mapping from the description · primary impact
33.5%Top 1.6%
73.1priority
CVE-2013-3918Microsoft Windows Out-of-Bounds Write Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more · 1 report
MITRE CTID mapping of the CVE · uncategorised
73.7%Top 0.53%
72.9priority
CVE-2020-0968Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVRansomwareHigh · 7.5T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
30.7%Top 1.8%
72.9priority
CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution Vulnerability
Adobe · Acrobat and ReaderKEVPublic exploitHigh · 8.6T1204.002Malicious File T1203Exploitation for Client Execution
AI mapping from the description · primary impact
7.2%Top 5.7%
72.9priority
CVE-2019-13720Google Chrome WebAudio Use-After-Free Vulnerability
Google · Chrome WebAudioKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution1 report
MITRE CTID mapping of the CVE · uncategorised
49.4%Top 1.1%
72.8priority
CVE-2023-43000Apple Multiple products Use-After-Free Vulnerability
Apple · Multiple ProductsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
4.0%Top 9.4%
72.3priority
CVE-2014-1761Microsoft Word Memory Corruption Vulnerability
Microsoft · WordKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution1 report
AI mapping from the description · primary impact
77.7%Top 0.43%
72.2priority
CVE-2012-1856Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
Microsoft · OfficeKEVHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution3 reports
MITRE CTID mapping of the CVE · uncategorised
72.0%Top 0.57%
71.8priority
CVE-2024-26169Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability
Microsoft · WindowsKEVRansomwareHigh · 7.8T1203Exploitation for Client Execution T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
4.0%Top 9.5%
71.6priority
CVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
2.4%Top 16%
71.0priority
CVE-2026-3909Google Skia Out-of-Bounds Write Vulnerability
Google · SkiaKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
2.3%Top 16%
70.9priority
CVE-2013-2551Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet ExplorerKEVRansomwarePublic exploitEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution2 reports
AI mapping from the description · primary impact
73.9%Top 0.52%
70.2priority
CVE-2020-15999Google Chrome FreeType Heap Buffer Overflow Vulnerability
Google · Chrome FreeTypeKEVPublic exploitCritical · 9.6T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
63.9%Top 0.78%
69.6priority
CVE-2025-31277Apple Multiple Products Buffer Overflow Vulnerability
Apple · Multiple ProductsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
1.7%Top 23%
69.5priority
CVE-2024-7971Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitCritical · 9.6T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
21.0%Top 2.4%
69.2priority
CVE-2008-0015Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
76.6%Top 0.46%
69.1priority
CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe · Acrobat and ReaderKEVPublic exploitHigh · 8.8T1203Exploitation for Client Execution T1204.002Malicious File
MITRE CTID mapping of the CVE · uncategorised
86.6%Top 0.26%
69.1priority
CVE-2017-8464Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1204.001Malicious Link T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
90.0%Top 0.21%
69.1priority
CVE-2018-0824Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1203Exploitation for Client Execution T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
73.0%Top 0.55%
69.1priority
CVE-2020-6418Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
78.8%Top 0.41%
69.1priority
CVE-2021-21224Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
84.2%Top 0.31%
69.1priority
CVE-2021-21220Google Chromium V8 Improper Input Validation Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
70.4%Top 0.61%
69.0priority
CVE-2021-30551Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
64.7%Top 0.76%
69.0priority
CVE-2021-30632Google Chromium V8 Out-of-Bounds Write Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
63.2%Top 0.8%
69.0priority
CVE-2017-5030Google Chromium V8 Memory Corruption Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
40.6%Top 1.4%
68.9priority
CVE-2019-11707Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
38.0%Top 1.5%
68.9priority
CVE-2019-17026Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the CVE · uncategorised
46.3%Top 1.2%
68.9priority
CVE-2020-16009Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
48.3%Top 1.1%
68.9priority
CVE-2021-38003Google Chromium V8 Memory Corruption Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
38.6%Top 1.4%
68.9priority
CVE-2016-5198Google Chromium V8 Out-of-Bounds Memory Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
34.2%Top 1.6%
68.8priority
CVE-2017-5070Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
32.1%Top 1.7%
68.8priority
CVE-2021-37975Google Chromium V8 Use-After-Free Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1059.007JavaScript T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
34.9%Top 1.6%
68.8priority
CVE-2014-0502Adobe Flash Player Double Free Vulnerablity
Adobe · Flash PlayerKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
24.8%Top 2.1%
68.7priority
CVE-2022-1096Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
24.7%Top 2.1%
68.7priority
CVE-2021-21148Google Chromium V8 Heap Buffer Overflow Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1059.007JavaScript T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
20.0%Top 2.6%
68.6priority
CVE-2024-5274Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitCritical · 9.6T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
7.7%Top 5.4%
68.6priority
CVE-2024-7965Google Chromium V8 Inappropriate Implementation Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
18.5%Top 2.8%
68.6priority
CVE-2022-1364Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
13.9%Top 3.5%
68.5priority
CVE-2022-26485Mozilla Firefox Use-After-Free Vulnerability
Mozilla · FirefoxKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
14.3%Top 3.4%
68.5priority
CVE-2017-0261Microsoft Office Use-After-Free Vulnerability
Microsoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client Execution T1204.002Malicious File
MITRE CTID mapping of the CVE · uncategorised
78.1%Top 0.42%
68.4priority
CVE-2011-0609Adobe Flash Player Unspecified Vulnerability
Adobe · Flash PlayerKEVPublic exploitHigh · 7.8T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more
AI mapping from the description · primary impact
63.5%Top 0.79%
68.3priority
CVE-2016-0185Microsoft Windows Media Center Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.8T1204.001Malicious Link T1203Exploitation for Client Execution
AI mapping from the description · primary impact
69.8%Top 0.63%
68.3priority
CVE-2017-8540Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
Microsoft · Malware Protection EngineKEVPublic exploitHigh · 7.8T1204.002Malicious File T1059Command and Scripting Interpreter+1 more
AI mapping from the description · primary impact
71.9%Top 0.57%
68.3priority
CVE-2023-21608Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe · Acrobat and ReaderKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
59.4%Top 0.88%
68.3priority
CVE-2024-44308Apple Multiple Products Code Execution Vulnerability
Apple · Multiple ProductsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
9.9%Top 4.4%
68.3priority
CVE-2025-6558Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Google · ChromiumKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
10.9%Top 4.1%
68.3priority
CVE-2025-5419Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
7.5%Top 5.5%
68.1priority
CVE-2025-6554Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.1T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
14.1%Top 3.4%
68.0priority
CVE-2025-2783Google Chromium Mojo Sandbox Escape Vulnerability
Google · Chromium MojoKEVPublic exploitHigh · 8.3T1203Exploitation for Client Execution T1548Abuse Elevation Control Mechanism+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
9.2%Top 4.7%
67.9priority
CVE-2025-30397Microsoft Windows Scripting Engine Type Confusion Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.5T1203Exploitation for Client Execution T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
27.3%Top 1.9%
67.9priority
CVE-2015-2424Microsoft PowerPoint Memory Corruption Vulnerability
Microsoft · PowerPointKEVHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution+1 more · 1 report
AI mapping from the description · primary impact
40.1%Top 1.4%
67.8priority
CVE-2024-0519Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
Google · Chromium V8KEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
3.8%Top 10%
67.2priority
CVE-2015-0359Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution1 report
AI mapping from the description · primary impact
92.1%Top 0.18%
66.4priority
CVE-2015-0336Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution1 report
AI mapping from the description · primary impact
70.4%Top 0.61%
65.7priority
CVE-2015-3090Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution+1 more · 1 report
AI mapping from the description · primary impact
83.2%Top 0.32%
65.4priority
CVE-2009-0075Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows…
Public exploitT1189Drive-by Compromise T1203Exploitation for Client Execution1 report
AI mapping from the description · primary impact
84.6%Top 0.3%
64.9priority
CVE-2023-6345Google Skia Integer Overflow Vulnerability
Google · Chromium SkiaKEVCritical · 9.6T1203Exploitation for Client Execution T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
16.5%Top 3%
64.1priority
CVE-2016-7256Microsoft Windows Open Type Font Remote Code Execution Vulnerability
Microsoft · WindowsKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
64.6%Top 0.76%
64.0priority
CVE-2007-0671Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft · OfficeKEVHigh · 8.8T1204.002Malicious File T1203Exploitation for Client Execution
AI mapping from the description · primary impact
43.2%Top 1.3%
63.9priority
CVE-2019-0903Microsoft GDI Remote Code Execution Vulnerability
Microsoft · Graphics Device Interface (GDI)KEVHigh · 8.8T1059Command and Scripting Interpreter T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
21.7%Top 2.4%
63.7priority
CVE-2021-21166Google Chromium Race Condition Vulnerability
Google · ChromiumKEVHigh · 8.8T1059.007JavaScript T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
24.0%Top 2.2%
63.7priority
CVE-2022-41128Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
Microsoft · WindowsKEVHigh · 8.8T1566Phishing T1203Exploitation for Client Execution+1 more
MITRE CTID mapping of the KEV entry · primary impact
24.6%Top 2.1%
63.7priority
CVE-2021-38406Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
Delta Electronics · DOPSoft 2KEVHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution
AI mapping from the description · primary impact
76.4%Top 0.46%
63.4priority
CVE-2012-2539Microsoft Word Remote Code Execution Vulnerability
Microsoft · WordKEVHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution
AI mapping from the description · primary impact
53.0%Top 1%
63.3priority
CVE-2016-3393Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability
Microsoft · WindowsKEVHigh · 7.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
68.5%Top 0.67%
63.3priority
CVE-2020-6572Google Chrome Media Use-After-Free Vulnerability
Google · Chrome MediaKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
10.6%Top 4.2%
63.3priority
CVE-2021-30761Apple iOS WebKit Memory Corruption Vulnerability
Apple · iOSKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
10.5%Top 4.2%
63.3priority
CVE-2022-32893Apple iOS and macOS Out-of-Bounds Write Vulnerability
Apple · iOS and macOSKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
9.9%Top 4.4%
63.3priority
CVE-2019-0752Microsoft Internet Explorer Type Confusion Vulnerability
Microsoft · Internet ExplorerKEVRansomwarePublic exploitEnd of lifeHigh · 7.5T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
81.7%Top 0.36%
63.2priority
CVE-2021-21206Google Chromium Blink Use-After-Free Vulnerability
Google · Chromium BlinkKEVHigh · 8.8T1059.007JavaScript T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
9.3%Top 4.6%
63.2priority
CVE-2021-30563Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8KEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
9.0%Top 4.7%
63.2priority
CVE-2023-23529Apple Multiple Products WebKit Type Confusion Vulnerability
Apple · Multiple ProductsKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
9.4%Top 4.6%
63.2priority
CVE-2021-33742Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability
Microsoft · WindowsKEVHigh · 7.5T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
59.4%Top 0.88%
63.1priority
CVE-2021-30554Google Chromium WebGL Use-After-Free Vulnerability
Google · Chromium WebGLKEVHigh · 8.8T1059.007JavaScript T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
7.4%Top 5.6%
63.0priority
CVE-2022-20703Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Cisco · Small Business RV160, RV260, RV340, and RV345 Series RoutersKEVHigh · 8.0T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
9.2%Top 4.7%
62.7priority
CVE-2022-20701Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
Cisco · Small Business RV160, RV260, RV340, and RV345 Series RoutersKEVHigh · 7.8T1078Valid Accounts T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
9.7%Top 4.5%
62.6priority
CVE-2021-34448Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Microsoft · WindowsKEVMedium · 6.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
40.1%Top 1.4%
62.5priority
CVE-2022-23748Dante Discovery Process Control Vulnerability
Audinate · Dante DiscoveryKEVHigh · 7.8T1059Command and Scripting Interpreter T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
8.3%Top 5.1%
62.4priority
CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Adobe · Acrobat and ReaderKEVHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · primary impact
6.7%Top 6%
62.3priority
CVE-2021-30665Apple Multiple Products WebKit Memory Corruption Vulnerability
Apple · Multiple ProductsKEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
3.7%Top 10%
62.1priority
CVE-2021-27059Microsoft Office Remote Code Execution Vulnerability
Microsoft · OfficeKEVHigh · 7.6T1203Exploitation for Client Execution
MITRE CTID mapping of the KEV entry · how it is exploited
6.1%Top 6.6%
62.0priority
CVE-2020-16013Google Chromium V8 Incorrect Implementation Vulnerabililty
Google · Chromium V8KEVHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
2.8%Top 14%
61.4priority
CVE-2025-24993Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Microsoft · WindowsKEVHigh · 7.8T1203Exploitation for Client Execution T1204User Execution+3 more
MITRE CTID mapping of the KEV entry · how it is exploited
2.2%Top 17%
60.0priority
CVE-2020-1380Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 7.8T1189Drive-by Compromise T1203Exploitation for Client Execution2 reports
AI mapping from the description · primary impact
24.2%Top 2.1%
59.2priority
CVE-2021-1905Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Qualcomm · Multiple ChipsetsKEVHigh · 7.8T1203Exploitation for Client Execution T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
1.5%Top 25%
58.4priority
CVE-2013-3163Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution1 report
MITRE CTID mapping of the CVE · uncategorised
70.7%Top 0.61%
57.9priority
CVE-2025-27038Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Qualcomm · Multiple ChipsetsKEVHigh · 7.5T1203Exploitation for Client Execution T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
1.0%Top 36%
56.1priority
CVE-2025-43200Apple Multiple Products Unspecified Vulnerability
Apple · Multiple ProductsKEVMedium · 4.2T1203Exploitation for Client Execution T1005Data from Local System+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
1.2%Top 32%
54.5priority
CVE-2009-0927Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
Adobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 8.8T1203Exploitation for Client Execution T1204.002Malicious File
MITRE CTID mapping of the CVE · uncategorised
96.6%Top 0.12%
54.1priority
CVE-2010-0249Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
AI mapping from the description · primary impact
91.9%Top 0.18%
54.1priority
CVE-2015-2502Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.8T1203Exploitation for Client Execution T1499.004Application or System Exploitation
MITRE CTID mapping of the CVE · uncategorised
51.0%Top 1.1%
53.9priority
CVE-2023-33063Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Qualcomm · Multiple ChipsetsKEVHigh · 7.8T1203Exploitation for Client Execution T1068Exploitation for Privilege Escalation
AI mapping from the description · primary impact
0.7%Top 48%
53.9priority
CVE-2015-2425Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
44.7%Top 1.2%
48.9priority
CVE-2017-0149Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution+1 more
MITRE CTID mapping of the CVE · uncategorised
29.2%Top 1.8%
48.8priority
CVE-2017-0222Microsoft Internet Explorer Remote Code Execution Vulnerability
Microsoft · Internet ExplorerKEVEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · uncategorised
29.6%Top 1.8%
48.8priority
CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Adobe · Flash PlayerKEVEnd of lifeHigh · 7.8T1203Exploitation for Client Execution T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
44.9%Top 1.2%
48.2priority
CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake
curl · curlPublic exploitHigh · 8.8T1203Exploitation for Client Execution1 report
AI mapping from the description · primary impact
78.7%Top 0.41%
37.0priority
CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be…
Public exploitT1203Exploitation for Client Execution T1202Indirect Command Execution+2 more
MITRE CTID mapping of the CVE · follow-on activity
19.7%Top 2.6%
24.5priority
CVE-2019-1052Chakra Scripting Engine Memory Corruption Vulnerability
Microsoft · Microsoft Edge (EdgeHTML-based)Medium · 4.2T1189Drive-by Compromise T1203Exploitation for Client Execution+2 more
MITRE CTID mapping of the CVE · how it is exploited
2.4%Top 16%
19.7priority
CVE-2019-1035Microsoft Word Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019T1203Exploitation for Client Execution T1204.002Malicious File+2 more
MITRE CTID mapping of the CVE · how it is exploited
6.6%Top 6.2%
19.4priority
CVE-2019-1106A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…
Microsoft · Microsoft EdgeT1189Drive-by Compromise T1203Exploitation for Client Execution+2 more
MITRE CTID mapping of the CVE · how it is exploited
9.2%Top 4.7%
19.1priority
CVE-2019-0926A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft…
Microsoft · Microsoft EdgeT1189Drive-by Compromise T1203Exploitation for Client Execution+2 more
MITRE CTID mapping of the CVE · how it is exploited
8.1%Top 5.2%
19.0priority
CVE-2018-5454Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are…
Philips · Philips IntelliSpace PortalT1203Exploitation for Client Execution
MITRE CTID mapping of the CVE · primary impact
3.4%Top 11%
17.8priority

Passages that support these links

CVE-2012-0158

CVE-2012-0158

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2012-0158

CVE-2012-0158 CVE-2017-0199

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2012-0158

CVE-2012-0158 CVE-2017-0199 CVE-2017-8759

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-11882

CVE-2012-0158 CVE-2017-0199 CVE-2017-8759 CVE-2017-11882

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-11882

CVE-2017-0199 CVE-2017-8759 CVE-2017-11882

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-11882

CVE-2017-8759 CVE-2017-11882

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-11882

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.

Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider QuoIntelligence, 29 Nov 2018 Original ↗

CVE-2018-0802

ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and

Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data documents.trendmicro.com Original ↗

CVE-2018-0802

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.

Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider QuoIntelligence, 29 Nov 2018 Original ↗

CVE-2017-0199

CVE-2012-0158 CVE-2017-0199

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-0199

CVE-2017-0199

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-0199

CVE-2017-0199 CVE-2017-8759

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2018-8174

**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.

Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider QuoIntelligence, 29 Nov 2018 Original ↗

CVE-2018-0798

x MITRE ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and CVE- 2018-0798

Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data documents.trendmicro.com Original ↗

CVE-2018-0798

During the last years, this OLE objects have been a good indicator that a document may aim to exploit the CVE-2018-0798 vulnerability in order to infect with some kind of malware.

TA428 Group abusing recent conflict between Iran and USA Lab52 / S2 Grupo, 9 Jan 2020 Original ↗

CVE-2017-8570

on a well-known Russian cybercrime forum, the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office ([CVE-2017-8570](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-8570)) and another that uses a malicious

EtterSilent: the underground’s new favorite maldoc builder Intel 471, 7 Apr 2021 Original ↗

CVE-2017-8759

CVE-2012-0158 CVE-2017-0199 CVE-2017-8759

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-8759

CVE-2017-0199 CVE-2017-8759

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗

CVE-2017-8759

CVE-2017-8759

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo, 30 May 2019 Original ↗