CVE-2023-21716 | Netskope Threat Labs

Description

This detection identifies exploitation attempts targeting CVE-2023-21716, which has a CRITICAL severity rating. Microsoft's advisory names this issue the Microsoft Word Remote Code Execution Vulnerability, which lets cyberattackers execute arbitrary code through specially crafted document files.

Stats

First seen: March 2023
Last seen: October 2026

CVEs

CVE-2023-21716

Alert name variants

Alert Name	Engine
Document-RTF.Exploit.CVE-2023-21716	ATP Sandbox Adv. Heuristics
Document.Exploit.CVE-2023-21716	ATP Sandbox Adv. Heuristics
Exploit.CVE-2023-21716.B	AV
Exploit.CVE-2023-21716.B:B2113	ATP Sandbox Adv. Heuristics
Exploit.CVE-2023-21716.C	AV
Exploit.CVE-2023-21716.Gen	AV
Exploit.CVE-2023-21716.Gen:91A40	ATP Sandbox Adv. Heuristics
Script.Exploit.CVE-2023-21716	ATP Sandbox Adv. Heuristics
Win32.Exploit.CVE-2023-21716	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
FILE-OFFICE Microsoft Office RTF font table memory corruption attempt	IPS-SWG

Related blogs

Threat Labs News Roundup: March 2023

April 10, 20234 min read

CVE-2023-21716: Microsoft Word RCE Vulnerability

March 27, 20232 min read

Related families

Microsoft

References

nvd.nist.gov