TI-2017-00180 Aliases CVE-2017-0194 GHSA-h6qg-53mg-343v

Information disclosure in Microsoft Office

MEDIUM 46CWE-200Published 2017-04-12 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."

Why it matters now

EPSS 0.2552 97th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Office	Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2	—	No fix listed	CNA

Office VendorMicrosoft Affected Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:excel:2007:sp3::::::	2007 sp3	Vulnerable	Microsoft
cpe:2.3:a:microsoft:excel:2010:sp2::::::	2010 sp2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:office_compatibility_pack::sp2::::::*	all versions	Vulnerable	Microsoft

cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:* Versions 2007 sp3 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:office_compatibility_pack:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-0194
2026-10-03 Alias added: GHSA-h6qg-53mg-343v

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0194

TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
TI-2009-00222 Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold… KEVCVSS 3.1HIGH 8.8
TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
TI-2021-18725 Microsoft Excel Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
TI-2016-06250 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016… KEVCVSS 3.1HIGH 7.8
TI-2009-02984 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for… KEVCVSS 3.1HIGH 7.8

See all 501 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences