## https://sploitus.com/exploit?id=3548C225-1BF9-5372-B726-948D360BBECC
# CVE-2023-21716 Analysis-ICT287: Microsoft Word Remote Code Execution
## Overview
This repository documents the analysis and reproduction of CVE-2023-21716, a heap-based buffer overflow vulnerability in Microsoft Word's RTF parser with a CVSS score of 9.8 (Critical).
## What's Inside
| File | Description |
|------|-------------|
| `CVE-2023-21716_Analysis_Report.pdf` | Full technical analysis including vulnerability explanation, impact assessment, VM setup guide, and exploit demonstration screenshots |
## Key Findings
- **Root Cause**: Improper bounds checking in `wwlib.dll` when parsing `\fonttbl` with excessive font IDs (`\f###`)
- **Impact**: Remote code execution with victim's privileges
- **Attack Vector**: Malicious RTF file delivered via email or file share
- **Verification**: Exception code `c0000374` confirms heap corruption
## Reproduction Environment
- Victim: Windows 7 + Microsoft Word 2016
- Attacker: Kali Linux
- Exploit Code: [JMousqueton/CVE-2023-21716](https://github.com/JMousqueton/CVE-2023-21716)
## Evidence
Screenshots in the report document:
- Crash window with "Microsoft Word has stopped working"
- Exception details showing `c0000374` (heap corruption)
- Email delivery method using ProtonMail
## My Contribution
- Researched and documented the vulnerability mechanics
- Set up isolated VM environment (Kali attacker, Windows 7 victim)
- Reproduced the exploit and captured heap corruption evidence
- Wrote comprehensive analysis report suitable for defensive security teams
## Disclaimer
This repository is for educational and defensive security purposes only. The exploit code was created by others and is linked for reference.
## Author
**Nabeel Aziz** โ [GitHub](https://github.com/Caliburn9)