CVE-2017-11882
Microsoft Office Memory Corruption Vulnerability
Description
CVE-2017-11882 is a high-severity memory corruption vulnerability in Microsoft Office that allows an attacker to run arbitrary code in the context of the current user. The vulnerability exists because Microsoft Office 2007 through 2016 fails to properly handle objects in memory, enabling remote code execution when a user opens a specially crafted document. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, and it is known to be used in ransomware campaigns. With an EPSS score of 94.38% (99.97th percentile), CVE-2017-11882 is among the most exploited vulnerabilities in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2007; 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882(Exploit, Third Party Advisory)
- http://www.securityfocus.com/bid/101757(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039783(Third Party Advisory, VDB Entry)
- https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html(Exploit, Third Party Advisory)
- https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html(Exploit, Patch, Third Party Advisory)
- https://github.com/0x09AL/CVE-2017-11882-metasploit(Exploit, Third Party Advisory)
- https://github.com/embedi/CVE-2017-11882(Exploit, Third Party Advisory)
- https://github.com/rxwx/CVE-2017-11882(Exploit, Third Party Advisory)
- https://github.com/unamer/CVE-2017-11882(Exploit, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882(Patch, Vendor Advisory)
- https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/(Exploit, Third Party Advisory)
- https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/(Exploit, Mitigation, Third Party Advisory)
- https://www.exploit-db.com/exploits/43163/(Exploit, Third Party Advisory, VDB Entry)
- https://www.kb.cert.org/vuls/id/421280(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a class of vulnerabilities where software performs operations on a memory buffer without properly restricting reads or writes to the intended boundaries. In the case of CVE-2017-11882, Microsoft Office improperly handles objects in memory, allowing an attacker to corrupt memory and execute arbitrary code through a specially crafted Office document.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-11882 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant security threat to organizations using affected Microsoft Office versions. The vulnerability requires local access through a malicious document but has low attack complexity and requires no authentication, though user interaction is needed to open the crafted file. Confidentiality (High): an attacker can gain full access to sensitive data accessible to the current user. Integrity (High): complete modification of files, data, and system configurations within the user's context is possible. Availability (High): full disruption of the Office application and potentially the user's system can occur. The EPSS score of 94.38% (99.97th percentile) places this vulnerability at the extreme end of exploitation probability. Critically, this vulnerability is known to be used in ransomware campaigns, significantly increasing the risk of data encryption and extortion for affected organizations.
Exploit Maturity
CVE-2017-11882 has an exceptionally mature exploit landscape and remains one of the most actively exploited vulnerabilities globally. CISA has listed it in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03, and ransomware usage is confirmed. Numerous public exploit resources are available, including proof-of-concept code on GitHub (embedi), GitHub (rxwx), a Metasploit module, and exploit write-ups on Exploit-DB. Additionally, in-depth analysis from Palo Alto Networks Unit 42 documents real-world exploitation patterns. The EPSS score of 94.38% (99.97th percentile) confirms that this vulnerability is among the most certain to be exploited, and its continued use in fileless attacks and phishing campaigns makes it a persistent threat.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the latest security update from the Microsoft Security Response Center.
- Verify that all instances of Microsoft Office 2007 Service Pack 3, Office 2010 Service Pack 2, Office 2013 Service Pack 1, and Office 2016 have been updated to patched versions across the organization.
- As an interim mitigation, disable the Equation Editor component (EQNEDT32.EXE) in Microsoft Office, which is the specific component containing the memory corruption vulnerability. This can be achieved through registry modifications or application control policies.
- Implement email security controls to scan incoming attachments for weaponized Office documents. Deploy sandbox detonation for suspicious Office files and block documents containing embedded OLE objects from untrusted sources.
- Enable Advanced Threat Protection (ATP) and configure endpoint detection and response (EDR) solutions to monitor for memory corruption exploitation patterns, including unusual child process creation from Office applications and unexpected network connections during document rendering.
Technical Details
CVE-2017-11882 is a memory corruption vulnerability in the Microsoft Equation Editor component (EQNEDT32.EXE), which is a legacy OLE component bundled with Microsoft Office 2007 through 2016. The vulnerability falls under CWE-119, where the software fails to properly restrict operations within the bounds of a memory buffer. Specifically, the Equation Editor does not validate the length of data before copying it into a fixed-size stack buffer, allowing a stack-based buffer overflow. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation requires local access through a malicious document with low complexity and no privileges, though user interaction to open the file is necessary. Notably, EQNEDT32.EXE runs as a separate process outside the Office application's memory space and lacks modern exploit mitigations such as ASLR and DEP, making exploitation highly reliable and enabling consistent code execution across different system configurations.
Frequently Asked Questions
Is CVE-2017-11882 being actively exploited?
Yes. CVE-2017-11882 is one of the most actively exploited vulnerabilities tracked by CISA. It is listed in the Known Exploited Vulnerabilities catalog, and ransomware campaigns are known to leverage this vulnerability. The EPSS score of 94.38% (99.97th percentile) confirms extremely high exploitation probability.
What products are affected by CVE-2017-11882?
CVE-2017-11882 affects Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016. Any system running these Office versions with the Equation Editor component is vulnerable.
How do I fix CVE-2017-11882?
Apply updates per vendor instructions by installing the latest Microsoft security update for all affected Office versions. As an additional measure, disable the Equation Editor component (EQNEDT32.EXE) through registry modifications or application control policies. Implement email security controls to detect and block weaponized Office documents.
How severe is CVE-2017-11882?
CVE-2017-11882 has a CVSS 3.1 score of 7.8 (HIGH) with full impact on confidentiality, integrity, and availability. Its EPSS score of 94.38% (99.97th percentile) places it among the most exploited vulnerabilities globally, and its confirmed use in ransomware campaigns makes it an extremely high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.