Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-21716-Analysis-ICT287 — Technical analysis and reproduction of CVE-2023-21716, a critical heap-based buffer overflow in Microsoft Word's RTF parser, including root cause, impact, and defensive guidance. | Kitploit
Tools/GitHubGitHub/caliburn9/cve-2023-21716-analysis-ict287
Vulnerability AnalysisExploitationMalware AnalysisPenetration TestingLearning & EducationBinary Exploitation
GitHubcaliburn9/cve-2023-21716-analysis-ict287

CVE-2023-21716-Analysis-ICT287

Technical analysis and reproduction of CVE-2023-21716, a critical heap-based buffer overflow in Microsoft Word's RTF parser, including root cause, impact, and defensive guidance.

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-21716 Analysis-ICT287: Microsoft Word Remote Code Execution

Overview

This repository documents the analysis and reproduction of CVE-2023-21716, a heap-based buffer overflow vulnerability in Microsoft Word's RTF parser with a CVSS score of 9.8 (Critical).

What's Inside

FileDescription
CVE-2023-21716_Analysis_Report.pdfFull technical analysis including vulnerability explanation, impact assessment, VM setup guide, and exploit demonstration screenshots

Key Findings

  • Root Cause: Improper bounds checking in wwlib.dll when parsing \fonttbl with excessive font IDs (\f###)
  • Impact: Remote code execution with victim's privileges
  • Attack Vector: Malicious RTF file delivered via email or file share
  • Verification: Exception code c0000374 confirms heap corruption

Reproduction Environment

  • Victim: Windows 7 + Microsoft Word 2016
  • Attacker: Kali Linux
  • Exploit Code: JMousqueton/CVE-2023-21716

Evidence

Screenshots in the report document:

  • Crash window with "Microsoft Word has stopped working"
  • Exception details showing c0000374 (heap corruption)
  • Email delivery method using ProtonMail

My Contribution

  • Researched and documented the vulnerability mechanics
  • Set up isolated VM environment (Kali attacker, Windows 7 victim)
  • Reproduced the exploit and captured heap corruption evidence
  • Wrote comprehensive analysis report suitable for defensive security teams

Disclaimer

This repository is for educational and defensive security purposes only. The exploit code was created by others and is linked for reference.

Author

Nabeel Aziz – GitHub

Download Tool