Vulnerability Details : CVE-2017-11826
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.
Vulnerability category: Execute code
Products affected by CVE-2017-11826
- cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps_server:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_online_server:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
CVE-2017-11826 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Office Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2017-11826
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2017-11826
94.95%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-11826
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-07-16 |
CWE ids for CVE-2017-11826
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-11826
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826
CVE-2017-11826 | Microsoft Office Remote Code Execution VulnerabilityPatch;Vendor Advisory
-
https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/
Exploiting Word: CVE-2017-11826 - Tarlogic Security - Cyber Security and Ethical hackingExploit;Third Party Advisory
-
https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/
Analyzing Microsoft Office Zero-Day Exploit CVE-2017-11826: Memory Corruption VulnerabilityBroken Link;Technical Description;Third Party Advisory
-
http://www.securityfocus.com/bid/101219
Microsoft Office CVE-2017-11826 Memory Corruption VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039541
Microsoft Word File Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html
0patch Blog: 0patching a Pretty Nasty Microsoft Word Type Confusion Vulnerability (CVE-2017-11826)Exploit
Jump to