CVE-2017-11826
Microsoft Office Remote Code Execution Vulnerability
Microsoft OfficeApplications & CMS
CVSS
7.8HighExploit odds (EPSS)81.3%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply updates per vendor instructions. CISA KEV
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
Description
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Text from CVE List
Affected versions 1
- Microsoft Officeaffected: Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, Office Online Server.CVE List
References 6
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826Advisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2017-11826Referencevia CISA KEV
- 0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.htmlReferencevia CVE List
- tarlogic.com/en/blog/exploiting-word-cve-2017-11826/Referencevia CVE List
- securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11826Referencevia CVE List