CriticalPublic exploitVulnerability

CVE-2023-21716

Microsoft Word RTF Heap Corruption Remote Code Execution

Published Feb 14, 2023 · Updated 28 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS9.8Critical · v3.1

EPSS84.8%100th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: Microsoft Corporation

IdentifiersCVE-2023-21716CWE-122

CVE-2023-21716 is a critical remote code execution vulnerability in Microsoft Word caused by heap corruption in the Microsoft Office wwlib component while parsing Rich Text Format content. The flaw resides in the Word RTF parser and can be triggered by a specially crafted RTF document. Successful exploitation occurs when the malicious document is opened in Word, and reporting also indicates the bug can be triggered when the document is merely previewed through Microsoft Outlook's preview pane. The vulnerability affects Microsoft Office and enables attacker-controlled memory corruption during document processing.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote code execution in the security context of the user running Microsoft Word or previewing the document through Outlook-integrated Word rendering. This can lead to full compromise of the affected workstation, including execution of follow-on payloads, malware installation, data theft, persistence, and potential lateral movement depending on the victim's privileges and enterprise controls.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by blocking or restricting RTF document handling, especially from untrusted or unsolicited sources, and by warning users not to open unexpected email attachments. Additional temporary risk reduction can include disabling or limiting document preview workflows in email clients where feasible and enforcing attachment filtering and detonation controls for Office and RTF content.

Remediation

Patch, then assume compromise.

Apply the Microsoft security updates released on 2023-02-14 for the affected Microsoft Office and Word products. Organizations should ensure all supported Office installations, including Microsoft 365 Apps and other affected Word-capable products, are updated to the vendor-fixed versions through normal patch management channels.

Public exploits

Exploits

5 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.

View more in app →

CVE-2023-21716This repository is a small standalone exploit generator for CVE-2023-21716, a Microsoft Word RTF parser heap corruption vulnerability. It contains two files: a README describing the vulnerability and operator workflow, and a single Python script, exploit.py, which is the functional entry point. The script does not exploit a target directly over the network; instead, it builds a malicious .rtf document for later delivery. The exploit capability is file-based initial access leading to code execution when the victim opens the crafted RTF in a vulnerable Word version. The Python code constructs an RTF document with an oversized \fonttbl containing 32,769 font definitions (FONTTBL_COUNT = 32769), intended to trigger a signed 16-bit counter overflow in Word's parser. It then embeds attacker-supplied raw shellcode into the RTF by converting the bytes into RTF hex escapes and placing them inside a \*\shppict{\pict...} block. The script reads shellcode from a local payload file and writes the final malicious RTF to a user-specified output path. Operationally, the repository expects the operator to generate shellcode separately, with the README showing an msfvenom example for a windows/x64/shell_reverse_tcp payload using LHOST and LPORT 4444. The script itself contains no built-in networking, callbacks, or C2 logic; any network behavior comes from the supplied shellcode. The README suggests delivery via SMB, email attachment, or phishing. Because it accepts arbitrary shellcode and produces a ready-to-deliver malicious document, this is best classified as an operational exploit builder rather than a mere proof of concept or detection script.REGGYRAIDER · Disclosed Jun 8, 2026 · python · markdown · file · email · webOperational CVE-2023-21716This repository is a proof-of-concept (POC) exploit for CVE-2023-21716, which targets a vulnerability in the RTF parser on Windows 10 systems. The repository contains three files: a LICENSE, a README.md, and the main exploit script (exploit.py). The exploit.py script generates a specially crafted RTF file ('exploit.rtf') with an extremely large font table (32,761 entries), which is designed to crash the RTF parser (such as Microsoft Word) when opened. This demonstrates a denial-of-service condition. The exploit is written in Python and is intended to be run on a system with Python 3.11. There are no network endpoints or remote attack vectors; the attack is local and requires the target to open the generated file. The repository is structured simply, with the exploit logic contained entirely in a single Python script.Xnuvers007 · Disclosed Mar 7, 2023 · python · localPoC CVE-2023-21716This repository provides a proof-of-concept (POC) exploit for CVE-2023-21716, a heap corruption vulnerability in Microsoft Word's RTF parser. The main exploit is implemented in 'POC-CVE-2023-21716.py', which generates a malicious RTF file ('POC-CVE-2023-21716.rtf') containing an oversized font table. When this file is opened in a vulnerable version of Microsoft Word (Office 365, 2016, 2013, 2010, or 2007), it can trigger heap corruption and potentially allow remote code execution with the victim's privileges. The repository also includes two YARA rules ('CVE-2023-21716.yar') for detecting RTF files crafted to exploit this vulnerability, and a brief README. The exploit is a POC and does not include a weaponized payload, but demonstrates the vulnerability's trigger condition. The main attack vector is via malicious document delivery (e.g., email attachment), and the primary fingerprintable endpoint is the generated RTF file.JMousqueton · Disclosed Apr 16, 2023 · python · yara · local · networkPoC CVE-2023-21716-POCThis repository provides a proof-of-concept (PoC) exploit for CVE-2023-21716, a critical heap buffer overflow vulnerability in Microsoft Word's handling of RTF files with oversized font tables. The repository contains two files: a detailed README.md explaining the vulnerability, affected products, and exploitation steps, and a Python script (RTF-creator.py) that generates a malicious RTF file ('malicious.rtf') with 32,761 font entries. Opening or previewing this file in a vulnerable version of Microsoft Word or Outlook triggers a crash due to heap corruption, as demonstrated by the included WinDbg analysis. The exploit is a PoC and does not include a remote code execution payload, but it effectively demonstrates the vulnerability by causing a crash. The main attack vector is via malicious file delivery (e.g., email attachment). No network endpoints or registry keys are involved; the only fingerprintable endpoint is the generated 'malicious.rtf' file.RonF98 · Disclosed Sep 16, 2024 · python · file · emailPoC CVE-2023-21716This repository is a minimal single-file Python proof-of-concept for CVE-2023-21716. The only file, exploit.py, generates a malicious RTF document named malicious.rtf. The script builds a basic RTF header, appends a very large number of font table entries with font IDs ranging from 0 to 32760, and finishes with a small footer before writing the result to disk. There is no networking, command execution, shell payload, or post-exploitation logic. The exploit capability is limited to file generation: it produces a crafted document intended to trigger a vulnerability in a target RTF parser, likely Microsoft Word/Office on Windows, when the file is opened. The repository structure is extremely simple and purpose-built as a crash/trigger POC rather than a weaponized exploit.muumthf · Disclosed Mar 22, 2026 · python · local filePoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationMicrosoft Officeapplication

Microsoft CorporationOffice Long Term Servicing Channelapplication

Microsoft CorporationOffice Online Serverapplication

Microsoft CorporationOffice Web Appsapplication

Microsoft CorporationOffice Web Apps Serverapplication

Microsoft CorporationSharepoint Enterprise Serverapplication

Microsoft CorporationSharepoint Foundationapplication

Microsoft CorporationSharepoint Serverapplication

Microsoft CorporationWordapplication

External references

References

MITRE CVEcve.org · CVE-2023-21716 NVDnvd.nist.gov/vuln/detail/CVE-2023-21716 MITRE CWE · CWE-122cwe.mitre.org Patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716

Activity feed

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

splunk researchNews · May 13, 2026Detection: Winword Spawning PowerShell | Splunk Security ContentA Microsoft Word RTF heap corruption vulnerability referenced as an associated analytic story; it is mentioned as related context rather than the main subject of this detection entry.Read more ↗splunk researchNews · May 13, 2026Detection: Office Product Spawn CMD Process | Splunk Security ContentA Microsoft Word RTF heap corruption vulnerability mentioned only as an associated analytic story.Read more ↗splunk researchNews · May 13, 2026Detection: Winword Spawning Windows Script Host | Splunk Security ContentA Microsoft Word RTF heap corruption vulnerability referenced as an associated analytic story; it is mentioned as related context for suspicious Winword.exe spawning script host processes, not analyzed in detail here.Read more ↗splunk researchNews · May 13, 2026Detection: Office Application Drop Executable | Splunk Security ContentA Microsoft Word RTF heap corruption vulnerability referenced only as an associated analytic story, not discussed in detail in the detection content.Read more ↗

+7 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malware14Malware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity1Community discussion across Reddit, Mastodon, and other social sources.