The vulnerability was being used in a 2008 Summer Olympics-themed attack.
Advisory: SB2008070801 - Remote code execution in Microsoft Word
Vulnerable component: Microsoft Word
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-119 - Memory corruption
The vulnerability alows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to buffer overflow when handling malformed Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Known APT campaigns:
Summer Olympics-themed attack
The attack was discovered by TrendMicro. The hackers used malicious Excel file as TROJ_MDROPPER.ZY, and the PowerPoint file as TROJ_PPDROP.M