RTF Protected-View Bypass (CVE-2026-21514) Chained with ShellLink RCE (CVE-2026-21510) — Builder Scripts
by ChaitanyaHaritash · 2026-07-05
- Severity
- High
- CVE
- CVE-2026-21514, CVE-2026-21510
- Category
- social-engineering
- Affected product
- Microsoft Office (RTF/Word rendering + Protected View) and Windows Shell Link (.lnk) handling
- Affected versions
- Office builds vulnerable to CVE-2026-21514 Protected View bypass; Windows hosts vulnerable to CVE-2026-21510
- Disclosed
- 2026-07-05
- Patch status
- unpatched
Tags
Archive entry
intelseclab/poc-archiveMetadata
| Field | Value |
|---|---|
| Date Added | 2026-07-05 |
| Last Updated | 2026-05 |
| Author / Researcher | ChaitanyaHaritash |
| CVE / Advisory | CVE-2026-21514, CVE-2026-21510 |
| Category | social-engineering |
| Severity | High |
| CVSS Score | Not specified in source |
| Status | PoC |
| Tags | rtf, lnk, ole-object, protected-view-bypass, cve-2026-21514, cve-2026-21510, phishing, initial-access |
| Related | See also pocs/social-engineering/2026-07-05_cve-2026-21510-lnk-stomping-generator |
Affected Target
| Field | Value |
|---|---|
| Software / System | Microsoft Office (RTF/Word rendering + Protected View) and Windows Shell Link (.lnk) handling |
| Versions Affected | Office builds vulnerable to CVE-2026-21514 Protected View bypass; Windows hosts vulnerable to CVE-2026-21510 |
| Language / Platform | Python 2/3-style scripts producing raw RTF and LNK binary files |
| Authentication Required | No |
| Network Access Required | Yes (embedded OLE object references a remote/UNC path to fetch the staged .lnk/payload) |
Summary
This repository contains two small builder scripts used to research a document-based attack chain: gen_rtf.py assembles a malicious RTF file containing an embedded OLE object whose payload is a hex-encoded UNC path (\\127.0.0.1@80\final.lnk) to a remotely staged .lnk, intended to bypass Office’s Protected View sandbox (CVE-2026-21514) when the RTF is opened. make_lnk.py builds the companion .lnk referenced by that path, embedding an HTML/JScript payload (via an ActiveXObject("htmlfile")/xmlfile COM trick) that loads a remotely hosted DLL (e.g. a Meterpreter reverse-TCP payload built with msfvenom) for code execution under CVE-2026-21510’s ShellLink handling flaw. Together the two scripts model a phishing chain: victim opens an RTF attachment, Office renders/loads the embedded object, which in turn resolves the linked .lnk, which then triggers execution of the attacker’s staged DLL/payload. The author’s own notes describe this as an evolving set of experiments (some primitives marked “Done”, others “Pending”), not a finished, production-grade exploit.
Vulnerability Details
Root Cause
CVE-2026-21514 stems from Office’s Protected View / sandbox failing to fully isolate certain embedded OLE object reference paths (e.g. paths interacting with word/_rels/webSettings.xml.rels-style diagnostics references), allowing an embedded object to reach outside the sandbox. CVE-2026-21510 (as in the companion LNK-stomping entry) is a ShellLink target-resolution/execution flaw that lets a crafted .lnk run an attacker-controlled command when opened.
Attack Vector
- Attacker builds a malicious
.lnkwithmake_lnk.py, embedding an HTML/JScript loader that references a remotely hosted DLL/payload via a UNC path. - Attacker builds a malicious RTF with
gen_rtf.py, embedding an OLE object whose payload data references the UNC path to that.lnk. - Attacker delivers the RTF (e.g. as an email attachment) to the victim.
- Victim opens the RTF; Office’s Protected View is bypassed (CVE-2026-21514), causing the embedded object/link to resolve.
- The referenced
.lnkis loaded, triggering CVE-2026-21510’s ShellLink execution flaw and running the attacker’s staged payload (e.g. a reverse shell DLL).
Impact
Remote code execution on the victim host from simply opening a document, chaining a sandbox/Protected-View bypass with a shortcut-execution flaw — a classic phishing-to-RCE initial-access chain.
Environment / Lab Setup
Target: Windows host with a vulnerable Microsoft Office build (RTF/Protected View) and vulnerable .lnk handling
Attacker: Python 2/3 (scripts use raw hex string manipulation), msfvenom for payload generation, a webserver/SMB share to host the staged .lnk and DLL
Proof of Concept
PoC Script
See
gen_rtf.pyandmake_lnk.pyin this folder.
| |
make_lnk.py writes final.lnk, embedding an HTML ActiveXObject/xmlfile loader that fetches and executes the staged DLL. gen_rtf.py writes an RTF containing an OLE object whose data block embeds the UNC path to final.lnk, to be delivered as a phishing attachment.
Detection & Indicators of Compromise
Signs of compromise:
- RTF attachments containing embedded
\objdatablocks referencing UNC paths (\\<ip>@<port>\...) .lnkfiles whose embedded strings referenceActiveXObject("htmlfile")/xmlfileCOM loaders- Unexpected outbound connections to non-corporate IPs immediately after opening an email attachment
Remediation
| Action | Detail |
|---|---|
| Primary fix | No vendor patch confirmed as of 2026-07-05 — monitor for Microsoft advisories for CVE-2026-21514 and CVE-2026-21510 |
| Interim mitigation | Block RTF/legacy Office formats at the mail gateway, enforce Protected View and disable OLE auto-activation via group policy, block outbound SMB/WebDAV to the internet |
References
Notes
Mirrored from https://github.com/ChaitanyaHaritash/CVE-2026-21514_CVE-2026-21510 on 2026-07-05.
| |