CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability. Microsoft

Microsoft Office Memory Corruption Vulnerability. Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

• CISA KEV-listed (remediation due 2022-05-03)
• used in ransomware campaigns
• EPSS 99.9% (100.0% percentile)
• CVSS 7.8 high

Detection rules

• Droppers Exploiting CVE-2017-11882 critical
• RegAsm.EXE Execution Without CommandLine Flags or Files low

Linked threat actors

• OilRig

Browse the CVE database

Read the full analysis on IntelFusions