Software Engineering Institute

Microsoft Word does not properly validate rich text within the contents of a file. When Word opens and parses a specially crafted file, memory corruption can occur and can allow arbitrary code execution. By convincing a user to open a specially crafted Word file, an attacker may be able to execute arbitrary code.

A remote, unauthenticated attacker may be able to execute arbitrary code or access the system with the privileges of the local user.

Apply an Update

Microsoft has released updates in Microsoft Security Bulletin MS07-024 to address this issue.

Workaround

Microsoft has provided the following workaround to mitigate this vulnerability:

Do not open or save Microsoft Office Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted file.