Microsoft: 0Day Exploit Targeting Word, Outlook
Summary: Microsoft warned that attackers are exploiting a previously unknown Word vulnerability that allows remote code execution when a user opens a specially crafted RTF file or previews an RTF email in Outlook with Word as the email viewer. Microsoft said the attacks seen so far were limited and targeted at Word 2010, while the flaw is also present in Word 2003, 2007, 2013, Word Viewer and Office for Mac 2011, and it issued a Fix-It that disables opening RTF content in Word until an official patch arrives.
Key Takeaway: Word is the default email reader in Outlook 2007, 2010 and 2013, so on those configurations a message can be exploited by preview alone, without the user opening an attachment. The attacker gains the same rights as the current user, which means running without admin rights reduces but does not remove the exposure.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026