CVE-2016-3357

This issue is like a “crash-and-control” bug inside Office’s handling of Word documents. If someone sends you a specially crafted file, opening it can let an attacker run harmful commands on your computer. Think of it as a broken door latch in the document viewer—when the right key (the file) is used, it can open the door to malware.

This matters if your business runs or allows document opening using Microsoft Office (including Word on Mac), Word Viewer, or the Office Web Apps/automation features tied to SharePoint in the specific listed versions. It does not require attackers to already be logged in, but it does require a user to open a malicious document. Your exposure depends on whether you use these vulnerable versions and whether attackers can get a crafted document to a user (for example via email or downloads).

Act with urgency: public exploits exist, and attackers can use this with a crafted document opened by a user. While it relies on user interaction (someone opening the file), that is common in day-to-day business, so unpatched systems are a realistic target.

1. Confirm where the vulnerability could exist in your environment:

• Workstations/desktops: machines running the vulnerable Microsoft Office/Word (including Word on Mac).
• Server-side/document automation: SharePoint Server/Foundation features that include Word Automation Services and any Office Web Apps/Office Web Apps Server components.
• Client viewing: Word Viewer deployments.

2. Inventory exact versions:

• For each Office/Word client, record the product name and service pack level.
• For SharePoint and Office Web Apps Server roles, record the installed build/edition and service pack.

3. Compare against the vulnerable set named in CVE-2016-3357:

• Examples of versions called out include Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Server/Foundation with the listed automation services on the listed service packs.

4. Patch plan (primary remediation):

• Apply the Microsoft update(s) from MS16-107 for every affected product/role you found in step 2.
• After installing, re-check the installed version/build to confirm it matches the patched state.

5. Temporary workaround if patching is delayed:

• Reduce the chance of a malicious file being opened:
  • Restrict or warn users against opening attachments from unknown/untrusted senders.
  • Consider blocking Word file types at the email gateway for external senders and allow only after a controlled scan/review.
  • If you must allow external documents, ensure they are handled through your security tooling (scanning/sandboxing) before reaching users.

6. What to monitor after patching:

• Review endpoint logs for unusual Office/Word spawned processes around the time users opened external documents.
• In server roles (SharePoint/Office Web Apps), monitor for abnormal service errors or unexpected process activity related to document rendering/automation.

Severity is High (CVSS 7.8) with a memory corruption weakness (CWE-119). The documented mechanism is arbitrary code execution triggered by opening a crafted document (“memory corruption vulnerability” in Office/Word document handling). Preconditions from the findings: no special privileges are required, but user interaction is required (a user must open the malicious file), and the attacker must deliver a crafted document to the victim. Exploitation status: a public exploit exists (at least one known). KEV is not listed by CISA in the provided findings, but press attention and a rising likelihood signal were noted; however, KEV status was not confirmed here. Prediction data was provided separately and should be treated as guidance only.