Recently, NSFOCUS CERT found the PoC that disclosed Microsoft Word remote execution code vulnerability (CVE-2023-21716) on the Internet. Because the RTF parser in Microsoft Word will trigger a heap corruption vulnerability when processing a font table (* fonttbl *) that contains too many fonts (* f # # # *), an attacker can exploit this vulnerability by sending a malicious email containing RTF payload, etc. When the user is successfully induced to open a crafted file on the affected system, an attacker without authentication can execute arbitrary code on the target system, The preview pane can also be used as an attack medium for this vulnerability. The CVSS score is 9.8. Please take measures to protect the affected users as soon as possible.
https://nsfocusglobal.com/microsoft-wor ... 023-21716/