{"id":"CVE-2017-11882","published":"2017-11-15T03:29:01Z","modified":"2026-06-17T01:02:31Z","title":"Microsoft Office Memory Corruption Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-11884.","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in Microsoft Office (2007 SP3, 2010 SP2, 2013 SP1 and 2016) stems from improper handling of objects in memory. An attacker can run arbitrary code in the context of the current user, and exploitation requires a local attack path with no privileges needed but user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:02Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99945,"percentile":0.99973,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11882","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-11-27","exploitedFirstSeen":"2017-11-27","ransomware":true,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/cobalt-malware-strikes-using-cve-2017-11882-rtf-vulnerability","date":"2017-11-27"},{"url":"https://www.riskiq.com/blog/labs/cobalt-strike/","date":"2017-11-28"},{"url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html","date":"2017-12-07"},{"url":"https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/17-year-old-ms-office-flaw-cve-2017-11882-actively-exploited-in-the-wild","date":"2017-12-08"},{"url":"https://www.freebuf.com/column/159865.html","date":"2018-01-10"},{"url":"https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/","date":"2018-01-16"},{"url":"https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf","date":"2018-01-27"},{"url":"https://community.rsa.com/t5/rsa-netwitness-platform-blog/lotus-blossom-continues-asean-targeting/ba-p/518891","date":"2018-02-13"},{"url":"https://www.trendmicro.com/en_us/research/18/c/tropic-trooper-new-strategy.html","date":"2018-03-14"},{"url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html","date":"2018-03-16"}],"evidenceTotal":225,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Trojan.PDF","url":"https://otx.alienvault.com/pulse/6ad908f59762145fa16a0c89","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101757","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039783","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/0x09AL/CVE-2017-11882-metasploit","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/embedi/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rxwx/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/unamer/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882","tags":["Patch","Vendor Advisory"]},{"url":"https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/","tags":["Exploit","Third Party Advisory"]},{"url":"https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/43163/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.kb.cert.org/vuls/id/421280","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/101757","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039783","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/0x09AL/CVE-2017-11882-metasploit","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/embedi/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rxwx/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/unamer/CVE-2017-11882","tags":["Exploit","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882","tags":["Patch","Vendor Advisory"]},{"url":"https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/","tags":["Exploit","Third Party Advisory"]},{"url":"https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/43163/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.kb.cert.org/vuls/id/421280","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882","tags":["US Government Resource"]}],"techniques":[{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Corruption","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office.  The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Corruption","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office.  The vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems.","confidence":"high"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","dataset-annotation"],"basisDetail":"CTID attack_to_cve (Phase 1); AnnoCTR expert entity-linking label (train split)","mappingType":"uncategorized","evidence":[{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2012-0158 [2]\r\no    CVE-2017-0199 [3]\r\no    CVE-2017-8759 [5]\r\no    CVE-2017-11882 [6]","start":6457,"end":6552},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2017-0199 [3]\r\no    CVE-2017-8759 [5]\r\no    CVE-2017-11882 [6]","start":6481,"end":6552},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2017-8759 [5]\r\no    CVE-2017-11882 [6]","start":6505,"end":6552},{"reportId":"SRC-e691b31be0c8233f6eab","quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"TRAM2 annotated sentence label","mappingType":null,"evidence":[{"reportId":"SRC-eab7254e3b05d632fdf6","quote":"RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.","start":3376,"end":3538}],"confidence":"low","confidenceNote":"machine-matched from report text"},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"AnnoCTR expert entity-linking label (train split)","mappingType":null,"evidence":[{"reportId":"SRC-e691b31be0c8233f6eab","quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-c25100ad56d1b485f562","title":"Bitter APT adds Bangladesh to their targets","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/bitter-apt-adds-bangladesh-to-their/","date":"2022-05-11","mentions":[{"quote":"the Equation Editor application is automatically launched to run the embedded objects containing the shellcode to exploit known vulnerabilities described by CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802 — all in Microsoft Office — then downloads the trojan from the hosting server and runs it on the victim's","start":1243,"end":1553},{"quote":"The Malicious RTF document is weaponized to exploit the stack overflow vulnerability CVE-2017-11882, which enables arbitrary code execution on victims' machines running vulnerable versions of Microsoft Office.","start":7642,"end":7851}]},{"id":"SRC-0630b30b056c45f2528d","title":"New Formbook Campaign Delivered Through Phishing Emails","publisher":"netskope.com","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails","date":"2022-03-11","mentions":[{"quote":"The infected spreadsheet delivers the threat through vulnerability described under CVE-2017-11882 and CVE-2018-0798.","start":2094,"end":2210}]},{"id":"SRC-11f1579485dc132ea05e","title":"OutSteel, SaintBot Delivered by Spear Phishing Attacks Targeting Ukraine Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader Saint","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/","date":"2022-02-26","mentions":[{"quote":"Even the Word documents attached to emails have used a variety of techniques, including malicious macros, embedded JavaScript and the exploitation of CVE-2017-11882 to install payloads onto the system.","start":3142,"end":3343}]},{"id":"SRC-ceefdd3b373149b188b8","title":"Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","publisher":"Lab52 / S2 Grupo","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","date":"2019-05-30","mentions":[{"quote":"o    CVE-2017-11882 [6]","start":6529,"end":6552},{"quote":"<http://cve.circl.lu/cve/CVE-2012-0158>\r\n[3] http://cve.circl.lu/cve/CVE-2017-0199\r\n[4] <https://attack.mitre.org/matrices/enterprise/>\r\n[5] <http://cve.circl.lu/cve/CVE-2017-8759>\r\n[6] <http://cve.circl.lu/cve/CVE-2017-11882>","start":13634,"end":13860}]},{"id":"SRC-e691b31be0c8233f6eab","title":"Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider","publisher":"QuoIntelligence","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/quoteintelligence_2018-11-29_golden-chickens-uncovering-a-malware.txt","date":"2018-11-29","mentions":[{"quote":"**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.","start":7733,"end":7941}]},{"id":"SRC-f6d8447098e456600b00","title":"A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity","publisher":"welivesecurity.com","url":"https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/","date":null,"mentions":[{"quote":"Files built with this tool are RTF documents exploiting Equation Editor N-day vulnerabilities such as CVE-2017-11882.","start":8892,"end":9009}]},{"id":"SRC-eab7254e3b05d632fdf6","title":"SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations","publisher":"blog.cyble.com","url":"https://blog.cyble.com/2023/06/01/sharppanda-apt-campaign-expands-its-arsenal-targeting-g20-nations/","date":null,"mentions":[{"quote":"RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.","start":3376,"end":3538}]},{"id":"SRC-9a7b4efe640b37a520f3","title":"Recent Cloud Atlas activity","publisher":"securelist.com","url":"https://securelist.com/recent-cloud-atlas-activity/92016/","date":null,"mentions":[{"quote":"Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.","start":1052,"end":1234}]},{"id":"SRC-87a65791d67ac3c1b33d","title":"VB2020 06","publisher":"vb2020.vblocalhost.com","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf","date":null,"mentions":[{"quote":"exploits (CVE-2017-11882 / CVE-2018-0802)","start":2283,"end":2324}]},{"id":"SRC-7337a86c8549e6b0b5ea","title":"2020 Financial Services and Insurance Industry Threat Report","publisher":"proofpoint.com","url":"https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-au-tr-financial-services-and-insurance.pdf","date":null,"mentions":[{"quote":"Engineering Office VBA Macro Thread Hijacking PowerShell WMI Keitaro TDS RIG Exploit Kit PDF\r\nXL4 Macro VBS Password Protected Regsvr32 Compressed Executable Geofencing Regsvcs/Regasm\r\nScheduled Task BITS Jobs HTML BlackTDS LCG Kit Executable CVE-2017-11882","start":24143,"end":24400},{"quote":"/1/20\r\n200k\r\n180k\r\n160k\r\n140k\r\n100k\r\n80k\r\n60k\r\n40k\r\n20k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML\r\nScheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882","start":27323,"end":27643},{"quote":"05/11/205/18/205/25/206/1/20\r\n600k\r\n400k\r\n300k\r\n200k\r\n100k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDFGeofencing XL4 MacroRegsvr32 Compressed Executable\r\nExecutableHTML Scheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882","start":33409,"end":33729}]},{"id":"SRC-5a45e0b34b5d082f1a6e","title":"FIN7.5: the infamous cybercrime rig “FIN7” continues its activities","publisher":"securelist.com","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/","date":null,"mentions":[{"quote":"To deliver their malware, the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882, or documents with Ole2Link and SCT.","start":10893,"end":11132}]},{"id":"SRC-2efed077c8da52f0bcef","title":"Agent Tesla | Old RAT Uses New Tricks to Stay on Top","publisher":"sentinelone.com","url":"https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/","date":null,"mentions":[{"quote":"Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns.","start":2709,"end":2865}]},{"id":"SRC-27a2071cb3ed3e110c59","title":"M-T RENDS2018","publisher":"static.carahsoft.com","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf","date":null,"mentions":[{"quote":"leveraged the Microsoft Office vulnerability CVE-2017-\r\n11882 to deploy POWRUNER and BONDUPDATER less","start":15266,"end":15367}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-3478","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3478","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":43163,"url":"https://www.exploit-db.com/exploits/43163","title":"Microsoft Office - OLE Remote Code Execution","type":"remote","platform":"windows","date":"2017-11-20","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-11-20"},"pocGithub":{"count":26,"skipped":10,"earliest":"2017-11-19","earliestUrl":"https://github.com/zhouat/cve-2017-11882","repos":[{"name":"Ridter/CVE-2017-11882","url":"https://github.com/Ridter/CVE-2017-11882","stars":535,"created":"2017-11-21"},{"name":"embedi/CVE-2017-11882","url":"https://github.com/embedi/CVE-2017-11882","stars":495,"created":"2017-11-20"},{"name":"rip1s/CVE-2017-11882","url":"https://github.com/rip1s/CVE-2017-11882","stars":330,"created":"2017-11-21"},{"name":"rxwx/CVE-2018-0802","url":"https://github.com/rxwx/CVE-2018-0802","stars":270,"created":"2018-01-11"},{"name":"Ridter/RTF_11882_0802","url":"https://github.com/Ridter/RTF_11882_0802","stars":166,"created":"2018-01-12"}]},"metasploit":[{"name":"Microsoft Office CVE-2017-11882","module":"exploit/windows/fileformat/office_ms17_11882","type":"exploit","disclosureDate":"2017-11-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb"}],"first":{"date":"2017-11-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Droppers Exploiting CVE-2017-11882","id":"678eb5f4-8597-4be6-8be7-905e4234b53a","level":"critical","status":"stable","path":"rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml","techniques":["T1203","T1204.002","T1566.001"]}]},"exploitRefs":["http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882","https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html","https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html","https://github.com/0x09AL/CVE-2017-11882-metasploit","https://github.com/embedi/CVE-2017-11882","https://github.com/rxwx/CVE-2017-11882","https://github.com/unamer/CVE-2017-11882","https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/","https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/","https://www.exploit-db.com/exploits/43163/"],"flow":[{"stage":"exploitation","techniques":["T1566.001"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"related","techniques":["T1203","T1204.002"],"provenance":"source","lowConfidence":true},{"stage":"observed","techniques":["T1566","T1072"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2017-11-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11882","provenance":"source"},{"date":"2017-11-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2017-11-19, Exploit-DB 2017-11-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb","provenance":"source"},{"date":"2017-11-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/cobalt-malware-strikes-using-cve-2017-11882-rtf-vulnerability","provenance":"source"},{"date":"2018-11-29","kind":"report","label":"Named in QuoIntelligence: Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/quoteintelligence_2018-11-29_golden-chickens-uncovering-a-malware.txt","provenance":"machine"},{"date":"2019-05-30","kind":"report","label":"Named in Lab52 / S2 Grupo: Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3478","provenance":"source"},{"date":"2022-02-26","kind":"report","label":"Named in unit42.paloaltonetworks.com: OutSteel, SaintBot Delivered by Spear Phishing Attacks Targeting Ukraine Spear Ph…","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/","provenance":"machine"},{"date":"2022-03-11","kind":"report","label":"Named in netskope.com: New Formbook Campaign Delivered Through Phishing Emails","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails","provenance":"machine"},{"date":"2022-05-11","kind":"report","label":"Named in blog.talosintelligence.com: Bitter APT adds Bangladesh to their targets","url":"https://blog.talosintelligence.com/bitter-apt-adds-bangladesh-to-their/","provenance":"machine"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1449},"priority":{"score":88.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3259 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":10.0,"detail":"13 reports"},{"name":"Public exploit code","points":5.0,"detail":"10 NVD references tagged Exploit; 1 Exploit-DB entry; 26 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-119"}}