PT-2017-2949 · Microsoft · Word Automation Services+6

Published 2017-10-10 · Updated 2025-04-07 · CVE-2017-11826

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 through 2016 Microsoft Office Web Apps Server versions 2010 through 2013 Office Online Server SharePoint Enterprise Server 2010 SharePoint Server 2010 Word Viewer Word Automation Services

Description A remote code execution issue exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the issue could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the issue requires that a user open a specially crafted file with an affected version of Microsoft Office software.

Recommendations For Microsoft Office versions 2007 through 2016, update to a newer version to mitigate the risk. For Microsoft Office Web Apps Server versions 2010 through 2013, update to a newer version to mitigate the risk. For Office Online Server, update to a newer version to mitigate the risk. For SharePoint Enterprise Server 2010 and SharePoint Server 2010, update to a newer version to mitigate the risk. For Word Viewer and Word Automation Services, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted files with affected versions of Microsoft Office software until a patch is available.

Exploit

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-02274

CVE-2017-11826

Affected Products

Office

Office Online Server

Office Web Apps Server

Office Word

Sharepoint Server

Word Automation Services

Word Viewer

References · 17

• 🔥 https://github.com/thatskriptkid/CVE-2017-11826 · Exploit
• 🔥 https://0patch.blogspot.com/2017/11/0patching-pretty-nasty-microsoft-word.html · Exploit
• 🔥 https://tarlogic.com/en/blog/exploiting-word-cve-2017-11826 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11826 · Security Note
• https://bdu.fstec.ru/vul/2017-02274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-11826 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11826 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826 · Vendor Advisory
• https://t.me/cvenotify/110579 · Telegram Post
• https://vuldb.com/?id.107703 · Note
• https://tools.cisco.com/security/center/viewAlert.x?alertId=55566 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• http://securityfocus.com/bid/101219 · Note
• https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11826 · Note