CVE-1999-0354
HighExploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Internet Explorer 4.x and 5.x in conjunction with Word 97 allows arbitrary execution of Visual Basic programs on the IE client through the Word 97 template, which does not warn the user that it contains executable content. This vulnerability also applies to Outlook when the client views a malicious email message.
Risk Assessment
The organization may be exposed to the execution of malicious code, potentially leading to data loss or system takeover. Users may be unaware of the threat, increasing the risk.
Recommendation
It is recommended to update Internet Explorer and Office to the latest versions, as well as to implement security filters for email messages. Users should be educated about potential threats associated with opening external templates.
Original NVD description (English source)
Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the IE client through the Word 97 template, which doesn't warn the user that the template contains executable content. Also applies to Outlook when the client views a malicious email message.