CVE-2014-1757

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-08 · updated 2026-06-17
Weakness: CWE-119

Description

Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer format, which allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office File Format Converter Vulnerability."

Affected products

Microsoft Office Compatibility Pack: all versions
Microsoft Word for Android: 2007-sp3, 2010-sp1, 2010-sp2

References

http://www.kb.cert.org/vuls/id/882841
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017
http://www.kb.cert.org/vuls/id/882841
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017

Get alerted when CVE-2014-1757 or the next vulnerability affects your stack