7.8
High
Exploited
CVE-2017-11826 Microsoft Office Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-119
Description
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Office | Versions not published |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
- 0patch.blogspot.com 0patch.blogspot.com
- 101219 www.securityfocus.com
- www.tarlogic.com www.tarlogic.com
- 1039541 www.securitytracker.com
- securingtomorrow.mcafee.com securingtomorrow.mcafee.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Microsoft Office
The 45 CVEs of Microsoft Office →
CVE-2018-0922
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac,…
Not rated
CVE-2018-0919
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac,…
Not rated
CVE-2018-0852
Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016,…
Not rated
CVE-2018-0841
Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in…
Not rated