External risk intelligence

Microsoft Word Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-21716

The vulnerability affects Microsoft Word and related office/sharepoint products. While these applications are widely used, they are primarily client-side productivity tools or internal enterprise collaboration platforms that are not typically exposed directly to the public internet in normal deployment patterns.

Integer Overflow

Microsoft Office

2019202120162013

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified affecting Microsoft Word and related Office and SharePoint products. This issue could allow for remote code execution, meaning an attacker could potentially run unauthorized commands on a system. The main concern is confirming whether our environment utilizes the affected versions of these Microsoft products.

Attackers can run code remotely on affected systems.
Widely used Microsoft products are potentially impacted.
Confirm relevance and exposure of affected products.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted document to a user. If the user opens this document in a vulnerable version of Microsoft Word, the attacker could potentially execute arbitrary code on the user's system, leading to a complete compromise.

No user interaction required.
Opens malicious document.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code when a user opens a specially crafted document in Microsoft Word. This could lead to the compromise of the user's system or data.

User documents and system integrity at risk.
Malicious document opening could trigger exploit.
System compromise or data exposure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this is a Microsoft Office and SharePoint vulnerability, the application owners, infrastructure teams, and potentially vendor management teams are likely responsible for remediation. The first practical step is to identify all instances of the affected Microsoft products across the environment, confirm their exposure and criticality, and then assign ownership to begin planning the appropriate remediation, which may involve coordinated updates or patching within maintenance windows.

Identify affected Microsoft Office/SharePoint instances.
Verify business criticality and exposure.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Office and related software impacted by this?

This software suite includes Word, the widely used word processing application, alongside Office Online Server, Office Web Apps, and SharePoint. These products form the backbone of document creation, collaborative editing, and enterprise content management systems. They are essential tools for handling business documentation, sharing information, and managing organizational data across many environments.

What does CWE-190 mean for CVE-2023-21716?

CWE-190 refers to an Integer Overflow or Wraparound vulnerability. In the context of CVE-2023-21716, it means the software performs a calculation that results in a value too large for its allocated memory. This error can cause the application to behave unexpectedly, potentially allowing an attacker to bypass security controls and run their own code on your machine.

How is this vulnerability triggered?

The flaw is triggered when a vulnerable application processes a specially crafted, malicious document. While simply storing such a file on a system does not inherently trigger the code execution, opening it within an affected version of Microsoft Word is the primary path for exploitation. This process relies on the software incorrectly handling the document's structure during rendering.

Is my organization at risk from this?

Halo Surface Signal notes that while these tools are ubiquitous, they are primarily client-side productivity applications or internal collaboration platforms. They are not usually deployed with public internet exposure, which reduces the likelihood of external attacks. You should evaluate if any of your SharePoint instances are exceptions that are reachable from the internet.

What should I do first to manage this risk?

Your first step is to inventory your environment to locate all versions of the identified Microsoft products. Once you have a complete list, verify which systems are business-critical and check if any are exposed to external networks. After mapping these assets, coordinate with your infrastructure and application owners to prioritize patching based on those risk factors.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.