CVE-2017-11882 is a high-severity vulnerability affecting various versions of Microsoft Office. This vulnerability allows an attacker to run arbitrary code in the context of the current user, potentially taking control of the affected system. Systems running the mentioned versions of Microsoft Office are at risk.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if you're using Microsoft Office 2007 Service Pack 3, Office 2010 Service Pack 2, Office 2013 Service Pack 1, or Office 2016. The vulnerable component is the Equation Editor executable (EQNEDT32.EXE) with a file version of 2000.11.9.0. If you're running this specific version, you may be at risk. An attacker can exploit this vulnerability by convincing you to open a specially crafted Office document, potentially taking control of your system.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to take action to protect your system. First, apply the necessary security update provided by Microsoft. This can be found in the Microsoft Office Memory Corruption Vulnerability advisory. By updating your software, you'll help prevent attackers from exploiting this vulnerability and potentially taking control of your system.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named Microsoft Office Memory Corruption Vulnerability, was added on November 3, 2021, with a due date of May 3, 2022. To address this vulnerability, it's essential to apply updates according to the vendor's instructions.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-119. It is due to improper restriction of operations within memory buffers. This weakness allows attackers to execute arbitrary code and potentially control affected systems.

For more details

CVE-2017-11882 is a high-severity memory corruption vulnerability affecting Microsoft Office versions 2007, 2010, 2013, and 2016. This vulnerability, classified as CWE-119, allows attackers to execute arbitrary code and potentially control affected systems. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Fileless Attack in Word without Macros

• SecurityFocus BID 101757

• SecurityTracker ID 1039783 (1)

• Microsoft's Manual Patch for Equation Editor

• Proof-of-Concept Exploits on GitHub

• Microsoft Office Memory Corruption Vulnerability

• VU#421280 - Microsoft Office Equation Editor Stack Buffer Overflow