OnlyPatch
Microsoft Office Word

CVE-2023-21716 — Microsoft Word Remote Code Execution Vulnerability

Critical CVSS 9.8 EPSS 0.82302 2023-02 archive

Executive Summary

None

Overview

9.8
CVSS CRITICAL
Critical
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-190: Integer Overflow or Wraparound
Released Feb 14 2023
Last Updated Feb 14 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.82302 — 0.99631 percentile
NVD CVSS 9.8 CRITICAL — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 8.5

EPSS Score

0.82302
probability of exploitation in the next 30 days
0.99631 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

17 affected products
Product KB Article Severity Impact Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Critical Remote Code Execution No
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Critical Remote Code Execution No
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Critical Remote Code Execution No
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Critical Remote Code Execution No
Microsoft Office 2019 for Mac Release Notes (Security Update) Critical Remote Code Execution Maybe
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Critical Remote Code Execution No
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Critical Remote Code Execution No
Microsoft Office LTSC for Mac 2021 Release Notes (Security Update) Critical Remote Code Execution Maybe
Microsoft Office Online Server 5002309 (Security Update) Critical Remote Code Execution Maybe
Microsoft Office Web Apps Server 2013 Service Pack 1 5002313 (Security Update) Critical Remote Code Execution Maybe
Microsoft SharePoint Enterprise Server 2013 Service Pack 1 5002346 (Cumulative Update) 5002347 (Security Update) 5002312 (Security Update) Critical Remote Code Execution 5002336 5002235 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 15.0.5529.1000 Maybe None Microsoft SharePoint Enterprise Server 2016 5002325 (Security Update) Critical Remote Code Execution Maybe
Microsoft SharePoint Foundation 2013 Service Pack 1 5002347 (Security Update) 5002312 (Security Update) Critical Remote Code Execution 5002336 5002235 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 15.0.5529.1000 Maybe None Microsoft SharePoint Server 2019 5002342 (Security Update) 5002330 (Security Update) Critical Remote Code Execution 5002329 5002295 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 16.0.10395.20001 Maybe None Microsoft SharePoint Server Subscription Edition 5002353 (Security Update) 5002352 (Security Update) Critical Remote Code Execution 5002331 5002291 Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 16.0.15601.20478 Maybe None Microsoft Word 2013 RT Service Pack 1 5002316 (Security Update) Critical Remote Code Execution Maybe
Microsoft Word 2013 Service Pack 1 (32-bit editions) 5002316 (Security Update) Critical Remote Code Execution Maybe
Microsoft Word 2013 Service Pack 1 (64-bit editions) 5002316 (Security Update) Critical Remote Code Execution Maybe
Microsoft Word 2016 (32-bit edition) 5002323 (Security Update) Critical Remote Code Execution Maybe
Microsoft Word 2016 (64-bit edition) 5002323 (Security Update) Critical Remote Code Execution Maybe
SharePoint Server Subscription Edition Language Pack 5002352 (Security Update) Critical Remote Code Execution Maybe

Patches

8 patches
Article Type Restart
Click to Run Security Update No
Release Notes Security Update Maybe
5002309 Security Update Maybe
5002313 Security Update Maybe
5002325 Security Update Maybe
5002316 Security Update Maybe
5002323 Security Update Maybe
5002352 Security Update Maybe

Exploits & PoC

13 public PoCs
RepositoryStarsPublishedDescription
gyaansastra/CVE-2023-21716 59 2023-03-08 A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this
Xnuvers007/CVE-2023-21716 46 2023-03-07 RTF Crash POC Python 3.11 Windows 10
JMousqueton/CVE-2023-21716 8 2023-04-16 POC : CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption
hv0l/CVE-2023-21716_exploit 6 2023-03-24 test of exploit for CVE-2023-21716
FeatherStark/CVE-2023-21716 4 2023-03-07
RonF98/CVE-2023-21716-POC 4 2024-09-16 Proof Of Concept for CVE-2023-21716 Microsoft Word Heap Corruption
MojithaR/CVE-2023-21716-EXPLOIT.py 3 2023-11-04 This is an exploit file which is used to check CVE-2021-21716 vulnerability
Lord-of-the-IoT/CVE-2023-21716 2 2023-06-13 python program to exploit CVE-2023-21716
mikesxrs/CVE-2023-21716_YARA_Results 0 2023-03-08 Results of retrohunt for files matching YARA rules from https://github.com/AmgdGocha/Detection-Rules/blob/main/CVE-2023-21716.yar
P4x1s/CVE-2023-21716-POC 0 2023-03-10 Microsoft Word 远程代码执行漏洞
muumthf/CVE-2023-21716 0 2026-03-22 폰트 인덱스 처리에서 발생하는 signed overflow 취약점
Caliburn9/CVE-2023-21716-Analysis-ICT287 0 2026-05-07
REGGYRAIDER/CVE-2023-21716 0 2026-06-08 CVE-2023-21716 - Microsoft Word RTF fonttbl Heap Corruption RCE exploit with reverse shell payload

Detection Rules

Acknowledgments

Joshua J. Drake

On This Page