---
id: "CVE-2017-11882"
kind: "vulnerability"
aliases: ["CVE-2017-11882"]
title: "Microsoft Office: Microsoft Office Memory Corruption Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.99945
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Office", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "microsoft-office", "ransomware", "windows"]
not_affected_if: ["fully-patched-office"]
published_at: "2017-11-15T03:29:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11882", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-11882", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11882", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft Office: Microsoft Office Memory Corruption Vulnerability

Microsoft Office has a memory corruption flaw that lets a crafted document run code as the current user. Attackers are actively exploiting it in the wild and it is tied to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office affected ? fixed ?

## Fix

Apply the Microsoft Office security update per vendor instructions (CISA required action); the specific patched build is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11882
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-11882
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-11882

## From the sources

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_