CVE-1999-0354

High CVSS 7.5

Published 1999-11-01 · last changed 2026-06-16

The fix

We hold no Microsoft remediation data for CVE-1999-0354, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the IE client through the Word 97 template, which doesn't warn the user that the template contains executable content. Also applies to Outlook when the client views a malicious email message.

Sources

NVD record for CVE-1999-0354

CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P