CVE-2017-9433

What it actually does

Heap-based buffer overflow in MsWrd1Parser::readFootnoteCorrespondance triggers an out-of-bounds write during parsing of Microsoft Word footnote data structures.

Why it matters to the business

Remote attackers can achieve arbitrary code execution on systems that parse untrusted documents with the vulnerable library, potentially leading to full system compromise; the issue is over seven years old with no active exploitation campaigns reported.

How an attack unfolds

An attacker crafts a malicious document containing malformed footnote correspondence records. When a victim application linked against the vulnerable libmwaw parses the file, the MsWrd1Parser overflows a heap buffer, allowing the attacker to overwrite adjacent memory and gain control of execution flow.

How to fix it

Upgrade libmwaw to a version released after 2017-04-08 that contains the fix for the MsWrd1Parser buffer handling. Rebuild and redeploy any dependent applications or packages that statically or dynamically link the library.

How to confirm the fix worked

Confirm the installed libmwaw shared object or source revision is newer than the 2017-04-08 commit that addressed the overflow. Run regression tests with sample documents containing footnote structures and monitor for crashes or sanitizer violations.

Typical attack path

1. Craft malicious document exploiting footnote parsing logic
2. Deliver document via email, web download, or file share
3. Victim opens document in an application that uses libmwaw
4. Parser executes readFootnoteCorrespondance and triggers heap overflow
5. Attacker-supplied payload executes with the privileges of the parsing process

How to detect it

Review application crash logs and memory sanitizer reports for heap corruption when opening Microsoft Word documents. Correlate process terminations or abnormal memory access patterns in binaries that depend on libmwaw.

What your security team should do

• Identify all software that ships or links libmwaw and schedule upgrades
• Block or sandbox document parsing workflows that rely on the affected library until patched
• Add libmwaw version checks to software inventory and vulnerability scanning processes