CVE-2013-3857
Microsoft Word Automation Services - Remote Code Execution via Crafted Office Document
Title source: llmDescription
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
References (5)
Core 5
Core References
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-253A
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18741
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18942
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-072
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067
Scores
EPSS
0.2103
EPSS Percentile
97.3%
Details
CWE
CWE-119
Status
published
Products (7)
microsoft/office_compatibility_pack
microsoft/office_web_apps
2010 sp1 (2 CPE variants)
microsoft/sharepoint_server
2010 sp1 (2 CPE variants)
microsoft/word
2003 sp3
microsoft/word
2007 sp3
microsoft/word
2010 sp1 (4 CPE variants)
microsoft/word_viewer
Published
Sep 11, 2013
Tracked Since
Feb 18, 2026