CVE Feed

    Dashboard / CVE / CVE-2017-11882

    CVE-2017-11882

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

    Published:Nov 15, 2017
    Last Modified:Apr 22, 2026
    EPS:Nov 15, 2017
    EPSS Score:0.94384
    CVSS Score:7.8

    CISA Notification

    Description

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    May 3, 2022
    1592 days ago
    Alert Date
    Nov 3, 2021
    1773 days ago

    Affected Products

    Vendor
    Microsoft
    Product
    Office

    Exploits

    http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.htmlhttps://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.htmlhttps://github.com/0x09AL/CVE-2017-11882-metasploithttps://github.com/embedi/CVE-2017-11882https://github.com/rxwx/CVE-2017-11882https://github.com/unamer/CVE-2017-11882https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/https://www.exploit-db.com/exploits/43163/http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.htmlhttps://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.htmlhttps://github.com/0x09AL/CVE-2017-11882-metasploithttps://github.com/embedi/CVE-2017-11882https://github.com/rxwx/CVE-2017-11882https://github.com/unamer/CVE-2017-11882https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/https://www.exploit-db.com/exploits/43163/https://www.exploit-db.com/exploits/43163https://github.com/0x09AL/CVE-2017-11882-metasploithttps://github.com/Abdibimantara/Maldoc-Analysishttps://github.com/ActorExpose/CVE-2017-11882https://github.com/BlackMathIT/2017-11882_Generatorhttps://github.com/ChaitanyaHaritash/CVE-2017-11882https://github.com/chanbin/CVE-2017-11882https://github.com/CSC-pentest/cve-2017-11882https://github.com/DONKEY0xSHOT/CVE-2017-11882-Blockerhttps://github.com/ekgg/Overflow-Demo-CVE-2017-11882https://github.com/embedi/CVE-2017-11882https://github.com/Grey-Li/CVE-2017-11882https://github.com/HaoJame/CVE-2017-11882https://github.com/herbiezimmerman/CVE-2017-11882-Possible-Remcos-Malspamhttps://github.com/HZachev/ABChttps://github.com/imkidz0/CVE-2017-11882https://github.com/j0lama/CVE-2017-11882https://github.com/jadeapar/Dragonfish-s-Malware-Cyber-Analysishttps://github.com/legendsec/CVE-2017-11882-for-Kalihttps://github.com/likekabin/CVE-2017-11882https://github.com/likekabin/CVE-2018-0802_CVE-2017-11882https://github.com/lisinan988/CVE-2017-11882-exphttps://github.com/littlebin404/CVE-2017-11882https://github.com/Mo200909/Office-Malware-Forensics-Lab-REMnux-Static-Analysishttps://github.com/n18dcat053-luuvannga/DetectPacket-CVE-2017-11882https://github.com/nhuynhuy/cve-2017-11882https://github.com/pixelofapicture/001-Malware-Analysis-CVE-2017-11882https://github.com/qy1202/https-github.com-Ridter-CVE-2017-11882-https://github.com/Retr0-code/SignHerehttps://github.com/Ridter/CVE-2017-11882https://github.com/Ridter/RTF_11882_0802https://github.com/rip1s/CVE-2017-11882https://github.com/rxwx/CVE-2018-0802https://github.com/Shadowshusky/CVE-2017-11882-https://github.com/starnightcyber/CVE-2017-11882https://github.com/Sunqiz/CVE-2017-11882-reproductionhttps://github.com/tzwlhack/CVE-2017-11882https://github.com/xdrake1010/CVE-2017-11882-Preventerhttps://github.com/yaseenibnakhtar/001-Malware-Analysis-CVE-2017-11882https://github.com/zhouat/cve-2017-11882

    Related CVEs

    CVE-2026-78439 (CVSS 8.8) — Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code ov…
    CVE-2026-70105 (CVSS 6.5) — Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information ove…
    CVE-2026-50387 (CVSS 7.8) — Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.…
    CVE-2026-45463 (CVSS 8.4) — Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code loc…
    CVE-2026-45461 (CVSS 8.4) — Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.…
    CVE-2026-45460 (CVSS 4.7) — Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.…
    CVE-2026-45474 (CVSS 8.4) — Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.…
    CVE-2026-45472 (CVSS 8.4) — Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.…
    CVE-2026-42832 (CVSS 7.7) — Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.…
    CVE-2026-40420 (CVSS 8.8) — Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.…

    References

    http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882
    http://www.securityfocus.com/bid/101757
    http://www.securitytracker.com/id/1039783
    https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html
    https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html
    https://github.com/0x09AL/CVE-2017-11882-metasploit
    https://github.com/embedi/CVE-2017-11882
    https://github.com/rxwx/CVE-2017-11882
    https://github.com/unamer/CVE-2017-11882
    https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
    https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/
    https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/
    https://www.exploit-db.com/exploits/43163/
    https://www.kb.cert.org/vuls/id/421280
    http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882
    http://www.securityfocus.com/bid/101757
    http://www.securitytracker.com/id/1039783
    https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html
    https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html
    https://github.com/0x09AL/CVE-2017-11882-metasploit
    https://github.com/embedi/CVE-2017-11882
    https://github.com/rxwx/CVE-2017-11882
    https://github.com/unamer/CVE-2017-11882
    https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
    https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/
    https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/
    https://www.exploit-db.com/exploits/43163/
    https://www.kb.cert.org/vuls/id/421280
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High