Loading vulnerability…
CVE-2014-1761 is a memory corruption vulnerability in Microsoft Word and related Microsoft Office components triggered by specially crafted Rich Text Format data. Affected products include multiple releases of Microsoft Word, Word Viewer, the Office Compatibility Pack, Office for Mac 2011, Word Automation Services on SharePoint Server, and Office Web Apps. Opening or otherwise processing a malicious RTF document can corrupt memory and allow attacker-controlled code execution in the context of the affected application. The flaw was exploited in the wild as a zero-day in targeted phishing campaigns, where weaponized RTF documents were used to deliver malware. The available information identifies crafted RTF parsing as the trigger condition, but does not provide a more specific vulnerable routine or function.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (ms14_017_rtf.rb) that exploits CVE-2014-1761, a vulnerability in Microsoft Word's handling of RTF files. The exploit works by generating a malicious RTF file that, when opened in a vulnerable version of Microsoft Word (notably Office 2010 SP2 on Windows 7 SP1), triggers an object confusion vulnerability, leading to arbitrary code execution. The module constructs a ROP chain and embeds a user-supplied Metasploit payload into the RTF file, using a template file (cve-2014-1761.rtf) as the base. The main fingerprintable endpoints are the generated malicious RTF file (default name 'msf.rtf') and the template file used for crafting the exploit. The exploit is weaponized, as it is part of the Metasploit framework and allows for customizable payloads. The attack vector is local, requiring the target to open the malicious file. The repository is structured as a single Ruby file implementing the exploit logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in multiple Microsoft Word releases triggered via crafted RTF data. In this campaign, it was used in a spearphishing attachment to drop and execute the Cueisfry downloader trojan.
A remote code execution vulnerability in Microsoft Word that can be exploited through malformed Office file handling, typically via phishing emails with malicious attachments.
A remote code execution vulnerability in Microsoft Office that can be exploited via maliciously crafted files, often used in targeted phishing attacks.
A Microsoft Office exploit used in malicious lure documents by ModifiedElephant to drop and execute malware during spearphishing campaigns.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.