Microsoft Office Memory Corruption Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

CISA: Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on 0patch.blogspot.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cv…ExploitThird Party Advisory
• www.securityfocus.com/bid/101757Third Party AdvisoryVDB Entry
• www.securitytracker.com/id/1039783Third Party AdvisoryVDB Entry
• 0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.htmlExploitThird Party Advisory
• 0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.htmlExploitPatchThird Party Advisory
• github.com/0x09AL/CVE-2017-11882-metasploitExploitThird Party Advisory
• github.com/embedi/CVE-2017-11882ExploitThird Party Advisory
• github.com/rxwx/CVE-2017-11882ExploitThird Party Advisory
• github.com/unamer/CVE-2017-11882ExploitThird Party Advisory
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882PatchVendor Advisory
• researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-i…ExploitThird Party Advisory
• web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vu…ExploitMitigationThird Party Advisory
• www.exploit-db.com/exploits/43163ExploitThird Party AdvisoryVDB Entry
• www.kb.cert.org/vuls/id/421280Third Party AdvisoryUS Government Resource
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource