KB5002265: Microsoft Word 2016 / 365 Security Update — RTF Heap Corruption (February 2023)
A heap corruption in Word's RTF parser allows remote code execution via a malicious RTF file, triggered from the Outlook Preview Pane without opening the document. Apply KB5002265 — rated 9.8 CRITICAL.
An attacker can achieve remote code execution with the privileges of the user who has Outlook open. Since the attack requires no interaction beyond the email arriving and being previewed, it is a zero-click exploit path in enterprise email environments. A successful attack allows full code execution, credential theft, and lateral movement.
Microsoft Word's RTF parser has a heap corruption vulnerability when processing an RTF document with an excessively large number of fonts in the font table. An attacker can send a malicious RTF document via email. Crucially, Outlook uses Word to render email previews — the vulnerability is triggered in the Outlook Reading Pane without the user opening or clicking anything.
Probably yes if any of these apply:
Affected OS versions
Microsoft rated CVE-2023-21716 as 9.8 CRITICAL on February 2023 Patch Tuesday. Proof-of-concept code was published by security researchers showing reliable exploitation. The Preview Pane attack vector means users need not double-click the attachment — simply having Outlook open with the malicious email visible in the reading pane is sufficient to trigger code execution.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5002265Manual remediation steps
⏱ 15 minutes (Office update, no reboot required)Check Office Version
# For Click-to-Run (Microsoft 365 / Office 2021):
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
Select-Object VersionToReport
# Must be >= 16.0.16130.20218 (Current Channel) / 16.0.15928.20298 (Monthly Enterprise)
# For MSI Office 2016/2019:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\16.0\Word\Security" |
Select-Object ErrorReportingState # Just to verify registry is accessible
Immediate Workaround
# Disable RTF rendering in Outlook (prevents Preview Pane attack)
# WARNING: This disables viewing RTF emails in the preview pane
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\Options\Mail" `
-Name ReadAsPlain -Value 1
Apply KB5002265
Verify
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5002265 | CVE-2023-21716 | Microsoft Word — RTF file format parser | 9.8 | NVD ↗ |