Vulnerability Details : CVE-2017-11826
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.
Vulnerability category: OverflowExecute code
CVE-2017-11826
is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Office Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2017-11826
Probability of exploitation activity in the next 30 days: 95.14%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-11826
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
nvd@nist.gov |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
nvd@nist.gov |
CWE ids for CVE-2017-11826
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-11826
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826
CVE-2017-11826 | Microsoft Office Remote Code Execution VulnerabilityPatch;Vendor Advisory
-
https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/
Exploiting Word: CVE-2017-11826 - Tarlogic Security - Cyber Security and Ethical hacking
-
https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/
Analyzing Microsoft Office Zero-Day Exploit CVE-2017-11826: Memory Corruption VulnerabilityTechnical Description;Third Party Advisory
-
http://www.securityfocus.com/bid/101219
Microsoft Office CVE-2017-11826 Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039541
Microsoft Word File Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html
0patch Blog: 0patching a Pretty Nasty Microsoft Word Type Confusion Vulnerability (CVE-2017-11826)
Products affected by CVE-2017-11826
- cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2007:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2013:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps:2013:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:web_applications:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2010:*:*:*:*:*:*:*