From helpnetsecurity.com
Patches for the flaw – which affects a wide variety of MS Office and SharePoint versions, Microsoft 365 Apps for Enterprise and other products – have been released by Microsoft last month.
CVE-2023-21716 and the PoC exploit
CVE-2023-21716 was discovered and privately disclosed by security researcher Joshua J. Drake in November 2022.
It is a heap corruption vulnerability in Microsoft Word’s RTF parser that, if triggered, allows attackers to achieve remote code execution with the privileges of the victim. The flaw does not require prior authentication: attackers can simply send a booby-trapped RTF file to the victim(s) via email.