CVE-2017-11774
Microsoft Office Outlook Security Feature Bypass Vulnerability
Published Oct 13, 2017 · updated Jun 16, 2026 · microsoft outlook
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2017 · Catalog
Detected
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe microsoft/outlook2010
- cpe microsoft/outlook2013
- cpe microsoft/outlook2016
- vendor Microsoft Officeversion unspecified
Sources
- CISA KEVCVE-2017-11774
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
cisa.gov - CVE.orgCVE-2017-11774
Official CVE identifier
cve.org - FIRST EPSSCVE-2017-11774
30-day exploitation probability 59.6%
first.org - NIST NVDCVE-2017-11774
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
nvd.nist.gov