# CVE-2017-11882

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

- Page: https://www.vulneraibility.com/cve/CVE-2017-11882
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03; known ransomware use
- EPSS: 99.94% (percentile 100.0)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 36 GitHub proofs of concept (first 2017-11-19)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-10)
- Weakness: CWE-119
- Published: 2017-11-15

## Affected versions

- Microsoft Corporation Microsoft Office: affected Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/embedi/CVE-2017-11882
- [other] https://github.com/unamer/CVE-2017-11882
- [other] http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882
- [other] https://github.com/rxwx/CVE-2017-11882
- [other] http://www.securityfocus.com/bid/101757
- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
- [other] https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/
- [other] http://www.securitytracker.com/id/1039783
- [advisory] https://www.kb.cert.org/vuls/id/421280
- [other] https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html
- [other] https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html
- [other] https://github.com/0x09AL/CVE-2017-11882-metasploit
- [exploit] https://www.exploit-db.com/exploits/43163/
- [other] https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.