ZeroDay Findings
Sign inSign up

Findings

CVE-2017-11826

Microsoft Office Remote Code Execution Vulnerability

Published Oct 13, 2017 · updated Jun 16, 2026 · microsoft office compatibility pack

Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2017 · Catalog

    Detected

    Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe microsoft/office compatibility packversion unspecified
  • cpe microsoft/office online server2016
  • cpe microsoft/office web apps server2010
  • cpe microsoft/office web apps server2013
  • cpe microsoft/office word viewerversion unspecified
  • cpe microsoft/sharepoint enterprise server2016
  • cpe microsoft/sharepoint server2010
  • cpe microsoft/sharepoint server2013
  • vendor Microsoft Officeversion unspecified

Sources

  • CISA KEVCVE-2017-11826

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

    cisa.gov
  • CVE.orgCVE-2017-11826

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-11826

    30-day exploitation probability 81.3%

    first.org
  • NIST NVDCVE-2017-11826

    Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software

    nvd.nist.gov

References