{"id":"CVE-2017-11826","published":"2017-10-13T13:29:02Z","modified":"2026-06-17T01:02:26Z","title":"Microsoft Office Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a memory-handling defect, classified as an improper restriction of operations within the bounds of a memory buffer, in Microsoft Office and related components, including Office 2010, Word 2007 through 2016, Word Viewer, SharePoint Server 2010 and Web Applications, Word Automation Services, and Office Online Server. An attacker who can get a user to interact with a crafted document or object could execute code in the context of the affected software, with no authentication required and with local access as the attack vector.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:46Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.81333,"percentile":0.99635,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11826","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-09-28","exploitedFirstSeen":"2017-09-28","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-09-28"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2017-Oct","date":"2017-10-10"},{"url":"https://www.fortinet.com/blog/threat-research/cve-2017-11826-exploited-in-the-wild-with-politically-themed-rtf-document","date":"2017-11-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/101219","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039541","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html","tags":["Exploit"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826","tags":["Patch","Vendor Advisory"]},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/","tags":["Broken Link","Technical Description","Third Party Advisory"]},{"url":"https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101219","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039541","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html","tags":["Exploit"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826","tags":["Patch","Vendor Advisory"]},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/","tags":["Broken Link","Technical Description","Third Party Advisory"]},{"url":"https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11826","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: user opens malicious Office document triggering exploit","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allow remote code execution when the software fails to properly handle objects in memory","start":234,"end":322}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: memory corruption yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow remote code execution when the software fails to properly handle objects in memory","start":234,"end":322}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-3426","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3426","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2018-02-09","earliestUrl":"https://github.com/thatskriptkid/CVE-2017-11826","repos":[{"name":"thatskriptkid/CVE-2017-11826","url":"https://github.com/thatskriptkid/CVE-2017-11826","stars":8,"created":"2018-02-09"}]},"first":{"date":"2018-02-09","source":"PoC-in-GitHub","url":"https://github.com/thatskriptkid/CVE-2017-11826"},"provenance":"source"},"exploitRefs":["https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html","https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-09-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2017-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11826","provenance":"source"},{"date":"2018-02-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/thatskriptkid/CVE-2017-11826","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3426","provenance":"source"}],"speed":{"daysToPublicExploit":119,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1602},"priority":{"score":68.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3318 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-119"}}