CVE-2017-11826

high Microsoft ⚠️ CISA KEV — Exploited in the Wild
CVSS v3 Base Score
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
90.8%
Exploitation probability in 30 days
Top 0% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Published: October 13, 2017 (3135 days ago)
Last Modified: April 22, 2026
Vendor: Microsoft
Source: NVD

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2022-03-03
Remediation Due: 2022-03-24 (⚠ 1513d overdue)

Description

Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.

CWE

CWE-119

Affected Products

microsoft office compatibility packmicrosoft office online servermicrosoft office web apps servermicrosoft office word viewermicrosoft sharepoint enterprise servermicrosoft sharepoint servermicrosoft word

References

🔗 www.securityfocus.com 🔗 www.securitytracker.com 🔗 0patch.blogspot.com 🔗 portal.msrc.microsoft.com 🔗 securingtomorrow.mcafee.com