Microsoft Office EPS Filter Remote Code Execution Vulnerability

CVE-2017-0262 is a remote code execution vulnerability affecting Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016. The issue is associated with Encapsulated PostScript (EPS) handling in Office, where malicious Office documents invoke FLTLDR.EXE to render embedded EPS content. Supporting reporting describes the flaw as an EPS type confusion involving a forged procedure object used with the PostScript forall operator to control operand stack values. Observed exploitation used heap spraying and forged objects to leak module base information for EPSIMP32.flt, then pivoted through a forged file object and the bytesavailable operator into a ROP chain and shellcode. In the wild, the vulnerability was delivered via spearphishing documents such as a Word document containing an embedded malicious EPS file and was used by APT28/Sofacy/Sednit to execute payloads including GAMEFISH and Seduploader.