VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 02:52 UTC
← Dashboard

CVE-2017-11882

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft O…

Read full description
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.8: +1.17
  • Fresh EPSS: 99.94%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 20 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Huntress
Press · 21 Nov 2025, 08:00 · CVE-2017-11882 Vulnerability: Analysis, Impact, Mitigation - Huntress
The Register
Press · 13 Aug 2025, 07:00 · Crooks can't let go: Active attacks target Office vuln patched 8 years ago - The Register
Acronis
Press · 19 May 2025, 07:00 · From banks to battalions: SideWinder’s attacks on South Asia’s public sector - Acronis
The Hacker News
Press · 16 Jan 2025, 08:00 · Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer - The Hacker News
Rescana
Press · 27 Sep 2024, 07:00 · Exploiting CVE-2017-11882: Critical Microsoft Office Vulnerability Targeted by APTs - Rescana
See all 20 source documents
Check Point Blog
Press · 08 Feb 2024, 08:00 · MalDocs in Word and Excel: A Persistent Cybersecurity Challenge - Check Point Blog
The Hacker News
Press · 21 Dec 2023, 08:00 · Hackers Exploiting MS Excel Vulnerability to Spread Agent Tesla Malware - The Hacker News
Qualys
Press · 04 Sep 2023, 07:00 · Top 20 Vulnerabilities Exploited by Cyber Attackers - Qualys
Kaspersky
Press · 08 Aug 2023, 07:00 · CVE-2017-11882 is still being exploited - Kaspersky
The Hacker News
Press · 22 Oct 2021, 07:00 · 'Lone Wolf' Hacker Group Targeting Afghanistan and India with Commodity RATs - The Hacker News
The Hacker News
Press · 03 May 2021, 07:00 · New Chinese Malware Targeted Russia's Largest Nuclear Submarine Designer - The Hacker News
SOC Prime
Press · 01 Apr 2021, 07:00 · CVE-2017-11882: Two-Decades-Old Vulnerability in Microsoft Office Still Actively Leveraged For Malware Delivery - SOC Prime
Infosecurity Magazine
Press · 15 May 2020, 07:00 · The Most Exploited Vulnerabilities by State Sponsored Actors, and the Easy Fix - Infosecurity Magazine
Cisco Talos Blog
Press · 15 Oct 2018, 07:00 · Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox - Cisco Talos Blog
Unit 42
Press · 19 Jan 2018, 08:00 · Traps Prevents Microsoft Office Equation Editor Zero-Day CVE-2018-0802 - Unit 42
www.trendmicro.com
Press · 20 Dec 2017, 08:00 · CVE-2017-11882 Exploited to Deliver a Loki Infostealer - www.trendmicro.com
Unit 42
Press · 08 Dec 2017, 08:00 · Analysis of CVE-2017-11882 Exploit in the Wild - Unit 42
Google Cloud
Press · 07 Dec 2017, 08:00 · New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit - Google Cloud
The Hacker News
Press · 15 Nov 2017, 08:00 · 17-Year-Old MS Office Flaw Lets Hackers Install Malware Without User Interaction - The Hacker News
BleepingComputer
Press · 14 Nov 2017, 08:00 · Office Equation Editor Security Bug Runs Malicious Code Without User Interaction - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

5

Public exploit entries / repo candidates

See 5 repos with metrics
RepositoryStarsForksLanguageUpdated
rxwx/CVE-2018-0802270127Python28 Feb 2018, 12:32
Ridter/RTF_11882_080216659Python12 Jan 2018, 11:42
0x09AL/CVE-2017-11882-metasploit9852Ruby21 Nov 2017, 20:34
BlackMathIT/2017-11882_Generator3418Python22 Nov 2017, 08:38
legendsec/CVE-2017-11882-for-Kali00—24 Nov 2017, 07:11
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.8; EPSS 99.9%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, no prior privileges, user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:48.666564+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
14 Nov 2017, 08:00
Published
15 Nov 2017, 03:00
Added to the CISA KEV catalog
03 Nov 2021, 00:00
Latest press mention
21 Nov 2025, 08:00
Score calculated
05 Nov 2026, 13:57
PoCs on GitHub
5 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar