CVE-2023-21716

What it actually does

CVE-2023-21716 is a critical remote code execution vulnerability in Microsoft Word and related Office/SharePoint document-rendering components. The flaw is triggered when a specially crafted document is parsed by vulnerable Word/Office code, potentially allowing attacker-controlled code execution with the privileges of the process or user handling the document. Because affected products include server-side Office rendering and SharePoint components, exposure is not limited to desktop users opening files; document preview, indexing, conversion, or server-side processing workflows may also create attack surface. Successful exploitation can compromise confidentiality, integrity, and availability of the affected workstation or server.

Why it matters to the business

Exploitation could allow an attacker to take control of systems that process malicious Office documents, leading to data theft, malware deployment, lateral movement, business disruption, and possible compromise of collaboration platforms such as SharePoint. The CVSS score is critical and the EPSS score is high, indicating meaningful likelihood of exploitation even though it is not currently listed in CISA KEV and no ransomware association is provided. Organizations that widely use Microsoft Office, SharePoint, or Office Online Server should treat remediation as high priority because document-based attack paths are common and often reach both end users and server-side processing infrastructure.

How an attack unfolds

An attacker prepares a malicious Word/Office document designed to trigger the vulnerable parsing behavior. The document is delivered to a target through email, file sharing, a web download, a collaboration site, or uploaded to a platform that performs Office document preview or conversion. When the vulnerable Word or Office rendering component parses the file, the exploit causes memory corruption or unsafe execution flow and runs attacker-controlled code. On an endpoint, this code typically executes in the context of the user who opened or previewed the file; on a server, it may execute in the context of the service account responsible for document rendering or indexing. The attacker can then drop payloads, establish persistence, steal documents or credentials accessible to the compromised context, and move laterally to additional systems.

How to fix it

Apply the Microsoft security updates released for CVE-2023-21716 to all affected Microsoft Office, Microsoft Word, Office LTSC, Office Online Server, Office Web Apps, SharePoint Foundation, SharePoint Server, and SharePoint Enterprise Server deployments. Use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to ensure all supported Office and SharePoint components receive the February 2023 security fixes or later cumulative updates. Because no exact fixed versions were provided, validate against Microsoft’s official Security Update Guide for the installed product channel, architecture, and build. Prioritize internet-facing or externally accessible SharePoint/Office Online Server systems, document conversion services, and high-risk user groups. Where immediate patching is not possible, restrict untrusted Office document handling, disable or limit document preview/conversion workflows where feasible, block unsolicited Office attachments from external senders, enforce Protected View and Attack Surface Reduction rules, and ensure endpoint detection is active for Office child-process creation and suspicious script execution.

How to confirm the fix worked

Confirm that all affected Office, Word, SharePoint, Office Web Apps, and Office Online Server installations are on builds that include the February 2023 security update or a later cumulative update. Inventory both desktop Office clients and server-side document-rendering components, including SharePoint farms and Office Online Server roles. Verify patch installation through Microsoft 365 Apps admin center, Windows Update history, installed update inventory, SharePoint build numbers, Office account build information, or enterprise software inventory tooling. Test that vulnerable versions are no longer present and that document preview/conversion services continue to function after patching. Review email gateway and file-upload controls to confirm malicious or untrusted Office documents are scanned and detonated where supported.

Typical attack path

1. Attacker identifies users or services likely to open, preview, index, or convert Microsoft Word/Office documents.
2. Attacker crafts a malicious Office document that triggers the vulnerable Word parsing behavior.
3. Attacker delivers the document through phishing email, file-sharing links, web downloads, collaboration portals, or upload to a document-processing service.
4. A vulnerable Microsoft Word, Office, Office Online Server, SharePoint, or Office Web Apps component parses the document.
5. The exploit executes code under the privileges of the affected user or service process.
6. Attacker deploys a second-stage payload, such as a downloader, beacon, credential theft tool, or remote access malware.
7. Attacker performs discovery, collects accessible files or credentials, and attempts lateral movement or persistence.

How to detect it

To determine whether exploitation already occurred, examine endpoint, email, web proxy, EDR, and server logs for suspicious Office document handling followed by process execution, payload download, or lateral movement. On endpoints, review Microsoft Defender for Endpoint, Sysmon, Windows Security logs, PowerShell logs, and application control logs for WINWORD.EXE or other Office processes spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, bitsadmin.exe, or unknown executables. On SharePoint, Office Online Server, or Office Web Apps systems, review IIS logs, ULS logs, application logs, and EDR process telemetry for document upload or preview requests followed by abnormal child processes, crashes, or outbound network connections from Office/SharePoint service processes. Search email security logs for suspicious Word attachments or links delivered shortly before execution events. Also review crash dumps, Windows Error Reporting artifacts, temporary Office files, recent document paths, downloaded files, and quarantine events. Because public exploit maturity is listed as none and no specific threat actor is provided, detection should focus on behavioral indicators of document-triggered code execution rather than a single known payload.

• WINWORD.EXE spawning cmd.exe
• WINWORD.EXE spawning powershell.exe
• WINWORD.EXE spawning wscript.exe
• WINWORD.EXE spawning cscript.exe
• WINWORD.EXE spawning mshta.exe
• WINWORD.EXE spawning rundll32.exe
• WINWORD.EXE spawning regsvr32.exe
• WINWORD.EXE spawning certutil.exe
• WINWORD.EXE spawning bitsadmin.exe
• WINWORD.EXE spawning curl.exe
• EXCEL.EXE spawning powershell.exe
• POWERPNT.EXE spawning powershell.exe
• OfficeClickToRun.exe spawning cmd.exe
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• soffice.bin spawning cmd.exe
• Microsoft Office Alert: Suspicious Office child process
• Event ID 4688 WINWORD.EXE cmd.exe
• Event ID 4688 WINWORD.EXE powershell.exe
• Event ID 4688 w3wp.exe powershell.exe
• Event ID 1 WINWORD.EXE powershell.exe
• Event ID 1 WINWORD.EXE cmd.exe
• Event ID 1 w3wp.exe powershell.exe
• %TEMP%\Word8.0\
• %TEMP%\Word Work File
• %APPDATA%\Microsoft\Word\STARTUP\
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WINWORD.EXE

What your security team should do

• Prioritize patching all Microsoft Word, Office, SharePoint, Office Web Apps, and Office Online Server systems because the vulnerability is critical and has a high EPSS score.
• Inventory server-side document processing paths, including SharePoint preview, Office Online Server, indexing, conversion, and file-upload workflows, not just desktop Office clients.
• Harden Office execution controls by enabling Protected View, blocking macros from the internet, and enforcing Microsoft Defender Attack Surface Reduction rules that prevent Office from creating child processes or launching executable content.
• Increase monitoring for Office applications spawning scripting interpreters, command shells, download utilities, or unknown binaries.
• Review inbound email, web proxy, EDR, and collaboration-platform telemetry for suspicious Office documents delivered around user compromise timelines.
• Place additional scrutiny on externally shared document libraries and uploaded files processed by SharePoint or Office Online Server.
• If patching must be delayed, reduce exposure by limiting preview/conversion of untrusted documents and applying attachment sandboxing or file-type restrictions.
• Run threat hunts for post-exploitation activity such as abnormal WINWORD.EXE child processes, unexpected web service child processes on SharePoint/Office servers, credential dumping, and outbound beaconing.