← CVE Radar
CVE-2017-11882Microsoft Office Memory Corruption Vulnerability
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
7.8 HIGHEPSS 99.94%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 9.3 | HIGH | 2.0NVD | AV:N/AC:M/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due May 3, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2017-11882
- Status
- Analyzed
- Assigner (CNA)
- microsoft
- Published
- Nov 15, 2017
- Last modified
- 2026-06-17 01:02 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Microsoft CorporationMicrosoft Office1 version range
- Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016
References
- reversingminds-blog.logdown.com http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882
- securityfocus.com http://www.securityfocus.com/bid/101757
- securitytracker.com http://www.securitytracker.com/id/1039783
- 0patch.blogspot.com https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html
- 0patch.blogspot.com https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html
- github.com https://github.com/0x09AL/CVE-2017-11882-metasploit
- github.com https://github.com/embedi/CVE-2017-11882
- github.com https://github.com/rxwx/CVE-2017-11882
- github.com https://github.com/unamer/CVE-2017-11882
- portal.msrc.microsoft.com https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
- researchcenter.paloaltonetworks.com https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/
- web.archive.org https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/
- exploit-db.com https://www.exploit-db.com/exploits/43163/
- kb.cert.org https://www.kb.cert.org/vuls/id/421280
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882