CVE-2017-11882KEV · OVERDUE

Microsoft Office Memory Corruption Vulnerability

High · published November 15, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

🚨 A sneaky memory mishap in Microsoft Office could let attackers run arbitrary code just by opening a malicious document! ⚡ Think of it like a restaurant where a waiter serves you a dish that secretly comes with a hidden ingredient — instead of just a meal, it leads to a total kitchen takeover! 🍽️ An attacker could gain full control of your system, allowing them to execute any code they choose, steal sensitive data, or even install malware. This kind of vulnerability could lead to a total compromise of your personal or organizational data — absolutely devastating!

Put simply

Think of it like a restaurant where a waiter serves you a dish that secretly comes with a hidden ingredient — instead of just a meal, it leads to a total kitchen takeover! 🍽️ The Microsoft Office Memory Corruption Vulnerability occurs because these Office versions fail to handle objects in memory correctly, potentially allowing an attacker to execute arbitrary code in the context of the current user.

What to do

An attacker could gain full control of your system, allowing them to execute any code they choose, steal sensitive data, or even install malware. This kind of vulnerability could lead to a total compromise of your personal or organizational data — absolutely devastating! To protect yourself, update all affected Office versions to the latest service packs immediately. Microsoft has released patches to address this vulnerability, so ensure you're running Office 2016 or earlier with the latest updates applied. Don't wait! You've got this! Follow these steps to secure your Office environment and keep those pesky threats at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99945 · 100.0th percentile
Published
2017-11-15T03:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 15 NOV 03:00Z
    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker…
    cvelistv5