Microsoft Word Critical Zero-Day Vulnerability Fixed With Tuesday Patch

Advertisement
By Tasneem Akolawala | Updated: 12 April 2017 19:05 IST
Highlights
  • Microsoft's fix comes just days after the bug came to light
  • The zero-day vulnerability affects all versions of Microsoft Word
  • The fix is a part of the regular Tuesday patch that Microsoft rolls out
Microsoft Word Critical Zero-Day Vulnerability Fixed With Tuesday Patch

Microsoft has rolled out a fix for the zero-day vulnerability in its Word productivity app that came to light a few days ago, when revealed by McAfee. This new zero-day exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10, and we recommend all users to download the fix.

The fix is a part of the regular Tuesday patch that Microsoft rolls out, and the company's quick response proves how critical the bug was - in fact, it had been actively exploited, with a fresh report by Proofpoint of more exploits coming in as well.

In its advisory, Microsoft notes, "A remote code execution vulnerability exists in the way that Microsoft Office and WordPad parse specially crafted files. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The update addresses the vulnerability by correcting the way that Microsoft Office and WordPad parses specially crafted files, and by enabling API functionality in Windows that Microsoft Office and WordPad will leverage to resolve the identified issue."

As we mentioned, McAfee first highlighted the exploit, and in its research report, it said that it discovered the exploit in action in late January. The samples collected by the team saw the exploit organised as Word files (more specially, RTF files with ".doc" extension name). All the user requires to do is open or preview the specially crafted file with an affected version of Microsoft Office or WordPad.

Advertisement

In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted file to the user and then convincing the user to open the file, Microsoft notes. We also recommend users to observe caution before opening Word files from untrusted sources.

 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement

Related Stories

Popular Mobile Brands
  1. OnePlus Pad 3 With 12,140mAh Battery Launched in India: Check Features
  2. Our Fault OTT Release Date: When and Where to Watch Final Chapter of Culpables Online?
  3. Oppo Teases Launch of New Smartphone in India; Could Be Reno 14
  4. AirPods Pro 2, AirPods 4 May Get New Head Gestures, Camera Control, More
  5. OnePlus 13s Review
  6. Best Smartphones Under Rs 25,000 in India: Check List
  7. Chenab Rail Bridge: the Tech Behind the World's Highest Railway Bridge
  8. Redmi Pad 2 With 9,000mAh Battery Launched in Global Markets: See Price
  9. OnePlus 13s vs iQOO 13: Price in India, Specifications Compared
  10. OnePlus 13s Launched in India: Know Price, Specifications and More
  1. Hugging Face Releases SmolVLA Open Source AI Model For Robotics Workflows
  2. Redmi Pad 2 With 9,000mAh Battery, MediaTek Helio G100 Ultra Chip Launched: Price, Specifications
  3. Alphabet CEO Expects to Keep Hiring Engineers as AI Advances
  4. Amazon Said to Be Preparing to Test Humanoid Robots for Deliveries
  5. Google Doubles Gemini 2.5 Pro Rate Limit for Google AI Pro Subscribers
  6. Apple Said to Have Given iPhone Repair Business to Tata India as Partnership Expands
  7. Huawei Pura 80 Pro, Pura 80 Pro+ Design Teased; Pre-Reservation Begin
  8. Mistral Code AI-Powered Coding Assistant Introduced for Enterprise Developers
  9. Nothing Headphone 1 Launch Date Set for July 1, to Arrive Alongside Nothing Phone 3
  10. Ethereum Foundation Announces Overhauled Treasury Strategy Amid Scaling Push
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.