boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2017-0281

CVE-2017-0281HIGH
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web …
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .1576   96.8     —
AFFECTED
  Product           Versions                                                                                                                                                                                                                                                                                                                                                          Fixed
  Microsoft Office  Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016. –  —
TIMELINE
  Sep 9   Reserved by microsoft
  May 12  Published (CNA: microsoft)
  Oct 15  ENRICHED — CVE-2017-0281 (Microsoft Corporation Microsoft Office). Received CVSS 7.8 and CPE data from NVD.
CNA: microsoft · CVSS v3.0 · 2 references · NVD status: Modified

Description

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
September 9, 2016ReservedReserved by microsoft
May 12, 2017PublishedPublished (CNA: microsoft)
October 15, 2026ENRICHEDENRICHED — CVE-2017-0281 (Microsoft Corporation Microsoft Office). Received CVSS 7.8 and CPE data from NVD.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Microsoft CorporationMicrosoft Office—Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016.—

References (2)

Related

Authoritative record: CVE-2017-0281 at cve.org

Vendors: microsoft

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2017-0281 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.