CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability
Microsoft · Office · NVD published 2017-11-15 · posted 2026-10-21 · last modified 2026-06-17
What it is
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
| Weakness | CWE-119 |
|---|---|
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (source: [email protected]) |
| CISA due date | 2022-05-03 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Initial Access → Execution |
Exploitation evidence
First exploit evidence seen: 2017-11-15 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2021-11-03. Source
Public exploit code
Metasploit
exploit/windows/fileformat/office_ms17_11882: Microsoft Office CVE-2017-11882 (disclosure 2017-11-15)
Exploit-DB
- EDB-43163: Microsoft Office - OLE Remote Code Execution (2017-11-20)
GitHub proof-of-concept repositories
35 public repositories from 33 accounts, first seen 2017-11-19. Most starred: Ridter/CVE-2017-11882 (535 stars), view repository.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.
Defend the Chain
The attack chain for CVE-2017-11882 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1566.001 Spearphishing Attachment CTID: exploitation technique
CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office. The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems.
How to fix it
CISA required action
Apply updates per vendor instructions. (source: CISA KEV)
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html (Exploit, Patch, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 (Patch, Vendor Advisory)
- https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/ (Exploit, Mitigation, Third Party Advisory)
MITRE ATT&CK mitigations for this chain
- M1049 Antivirus/Antimalware (for T1566.001, T1059) : Anti-virus can also automatically quarantine suspicious files.
- M1018 User Account Management (for T1566.001) : Apply user account management principles to limit permissions for accounts interacting with email attachments, ensuring that only necessary accounts have the ability to open or execute files. Restricting account privileges reduces the potential impact of malicious attachments by preventing unauthorized execution or spr
- M1047 Audit (for T1566.001, T1059) : Enable auditing and monitoring for email attachments and file transfers to detect and investigate suspicious activity. Regularly review logs for anomalies related to attachments containing potentially malicious content, as well as any attempts to execute or interact with these files. This practice helps identify spearp
- M1031 Network Intrusion Prevention (for T1566.001) : Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
- M1054 Software Configuration (for T1566.001) : Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform simil
- M1017 User Training (for T1566.001) : Users can be trained to identify social engineering techniques and spearphishing emails.
- M1021 Restrict Web-Based Content (for T1566.001, T1059) : Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachmen
- M1033 Limit Software Installation (for T1059) : Prevent user installation of unrequired command and scripting interpreters.
- M1045 Code Signing (for T1059) : Where possible, only permit execution of signed scripts.
- M1042 Disable or Remove Feature or Program (for T1059) : Disable or remove any unnecessary or unused shells or interpreters.
Detection Generic guidance
- Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.
- Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.
Sources
- NVD: CVE-2017-11882
- CVE.org record
- CISA Known Exploited Vulnerabilities catalog
- FIRST EPSS (2026-10-24)
- MITRE CTID Mappings Explorer: KEV → ATT&CK
- http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882 (Exploit, Third Party Advisory)
- http://www.securityfocus.com/bid/101757 (Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039783 (Third Party Advisory, VDB Entry)
- https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html (Exploit, Third Party Advisory)
- https://github.com/0x09AL/CVE-2017-11882-metasploit (Exploit, Third Party Advisory)
- https://github.com/embedi/CVE-2017-11882 (Exploit, Third Party Advisory)
- https://github.com/rxwx/CVE-2017-11882 (Exploit, Third Party Advisory)
- https://github.com/unamer/CVE-2017-11882 (Exploit, Third Party Advisory)
- https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/ (Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/43163/ (Exploit, Third Party Advisory, VDB Entry)
- https://www.kb.cert.org/vuls/id/421280 (Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882 (US Government Resource)