CVE-2017-8696

HIGH

Microsoft Windows Uniscribe - Remote Code Execution via Crafted Document or Email

Title source: llm

Description

Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to execute code remotely via a specially crafted website or a specially crafted document or email attachment, aka "Microsoft Graphics Component Remote Code Execution."

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1039344

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8696

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/100780

Scores

CVSS v3 7.5

EPSS 0.1426

EPSS Percentile 96.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (11)

microsoft/live_meeting 2007

microsoft/lync 2010 (2 CPE variants)

microsoft/lync 2013 sp1

microsoft/office_2007

microsoft/office_2010

microsoft/office_web_apps 2010 sp2

microsoft/office_word_viewer

microsoft/skype_for_business 2016

microsoft/windows_7

microsoft/windows_server_2008 (2 CPE variants)

... and 1 more

Published Sep 13, 2017

Tracked Since Feb 18, 2026