CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 February 2022, which means attackers have used it in real attacks. A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.
What this vulnerability class means in Microsoft Office
CVE-2017-8570 is a remote code execution flaw, so the dangerous part is not just that Office crashes or misbehaves, but that crafted content can trigger code execution in the context of the user opening it. In practice, that turns a document into an entry point for malware delivery, persistence, or follow-on compromise.
Because this issue is in Microsoft Office software and involves memory handling, it belongs to the class of parser and object-processing bugs that attackers often aim at productivity software. Those products are widely trusted, broadly deployed, and regularly exposed to untrusted files, which makes them high-value targets for initial access.
Why remote code execution in Office is dangerous
Remote code execution in a desktop productivity suite matters because Office files are routinely exchanged through email, chat, file shares, and document portals. If an attacker can get malicious content opened, they may gain code execution without needing to break perimeter defenses first.
The practical risk is that the exploit path can bypass normal user caution, especially when the lure looks like an ordinary business document. That makes this kind of flaw especially useful for phishing, targeted intrusion, and post-exploitation staging.
For authoritative versioning, exploitability details, and record context, readers should use the CVE Program entry model and the NIST National Vulnerability Database alongside the vendor advisory.
How organisations assess exposure and prioritise response
Exposure review starts with an asset inventory that tells you where Microsoft Office is installed, which business units rely on it, and which endpoints regularly process untrusted documents. If the software is internet-facing through document workflows, remote access, or shared processing systems, the urgency rises further.
For a flaw like this, the most important question is whether the vulnerable product is still present in active use and whether the organisation has a path for rapid patch deployment. That is why vulnerability management, KEV tracking, and vendor guidance matter more than generic severity labels alone. A practical starting point is a Vulnerability Management Guide that ties asset scope to KEV prioritisation, verification, and remediation tracking.
If the affected environment includes managed Microsoft 365 or Office deployments, central administration and consistent baseline control are often the difference between a contained issue and a broad exposure window. For that operational layer, the Microsoft 365 Security Guide is a useful companion for hardening, logging, and tenant-wide governance.
Remediation, detection, and compromise review
The best outcome is to apply the vendor fix promptly, but remediation should also include compensating controls while patching is pending. Those controls usually focus on reducing exposure to untrusted files, tightening endpoint protection, and limiting the number of users who can execute risky document workflows.
Detection needs to look beyond the patch itself. If exploitation occurred before remediation, teams should review endpoint telemetry, child process creation from Office applications, unexpected network connections, suspicious macro or object activity, and signs of secondary payload execution. Post-patch review matters because a successful exploit may have already delivered a loader, stolen data, or created persistence.
Where Office exploitation is used as an initial foothold, it often leads to credential theft, lateral movement, or further malware staging, so recovery should include an identity and session review where relevant. That is especially important when the attack chain reaches email, file shares, cloud access, or privileged admin workstations.
Risk and Threat Considerations
This vulnerability is dangerous because it combines common user behavior with a software class that attackers frequently weaponize. A successful exploit can turn a normal document-handling workflow into remote execution, which is a strong initial access mechanism for intrusion campaigns.
Failure mechanism: Maliciously crafted Office content abuses unsafe object or memory handling, causing the application to execute attacker-controlled code on the victim system.
Impact: Attackers can deliver malware, establish persistence, steal data, and pivot into broader internal compromise after the document is opened.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Microsoft Office RCEs require timely flaw remediation across affected endpoints. |
| SI-4 — System Monitoring | Office exploitation needs detection of abnormal process and network behavior after document opening. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-patch compromise review depends on analysing endpoint and application telemetry. | |
| Recommendation — Prioritise and verify remediation for exposed Office installations. Monitor for suspicious Office child processes, payload execution, and beaconing. Review logs and alerts for signs of pre-patch exploitation and persistence. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed Office flaws should be prioritised through continuous vulnerability management. |
| CIS-8 — Audit Log Management | Compromise review depends on preserved logs from endpoints and identity systems. | |
| Recommendation — Track Office exposure and drive rapid remediation for known exploited vulnerabilities. Centralise and retain logs needed to investigate Office exploit activity. | ||
Practitioner Guidance
Why practitioners should care: Treat document-processing vulnerabilities as exposure on a high-trust workstation path, not as isolated application defects. Office is often present on systems with broad email, file, and business-system reach, so exploitation can have outsized blast radius.
What to watch for: Prioritise any affected system that handles external documents, receives attachments at scale, or is used by users with elevated access. In those environments, confirm patch status quickly and review whether suspicious Office activity coincided with unexplained endpoint or account behavior.
Practitioner takeaway: When an Office RCE is disclosed, speed matters, but so does post-remediation review, because the real danger is not just exploitation of the flaw, it is what the attacker may have done before the patch landed.