Microsoft Word Remote Code Execution Vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. The file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Word software. Two possible email attack scenarios exist for this vulnerability: • With the first email attack scenario, an attacker could send a specially crafted email message to the user and wait for the user to click on the message. When the message renders via Microsoft Word in the Outlook Preview Pane, an attack could be triggered. • With the second scenario, an attacker could attach a specially crafted file to an email, send it to a user, and convince them to open it. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or other message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Word handles files in memory. For users who view their emails in Outlook, the Preview Pane attack vector can be mitigated by disabling this feature. The following registry keys can be set to disable the Preview Pane in Outlook on Windows, either via manual editing of the registry or by modifying Group Policy. Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Outlook 2010: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Options DWORD: DisableReadingPane Value: 1 Outlook 2013: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Options DWORD: DisableReadingPane Value: 1 Outlook 2016, Outlook 2019, and Office 365 ProPlus: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options DWORD: DisableReadingPane Value: 1
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Enterprise Server 2013 Service Pack 1 | 15.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2019 | 19.0.0 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office 2019 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Office 365 ProPlus | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Online Server | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2016 | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2016 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Web Apps 2010 Service Pack 2 | 13.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Web Apps Server 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
- Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Enterprise Server 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office 2019 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Office 365 ProPlus VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Online Server VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2016 VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2016 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Web Apps 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Web Apps Server 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft SharePoint Enterprise Server 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Enterprise Server 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2019 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
- Fix · CNA Microsoft Office 2019 for Mac (Microsoft) Fixed in publication
- Fix · CNA Office 365 ProPlus (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Online Server (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2016 for Mac (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Web Apps 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Web Apps Server 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1201
- 2026-10-03 Alias added: GHSA-mhjc-pqhq-cf8c
More Microsoft Office vulnerabilities
- TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
- TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
- TI-2018-00739 Out-of-bounds write in Microsoft Equation Editor KEVCVSS 3.1HIGH 8.8
- TI-2015-02130 Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2… KEVCVSS 3.1HIGH 8.8
- TI-2015-01588 Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2019-1201 · CVE Program
- CVE-2019-1201 · NVD
- FIRST EPSS
- GHSA-mhjc-pqhq-cf8c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences