Microsoft Outlook CVE-2017-11774

Exploitation requires the user to open Microsoft Outlook and access a folder (typically Inbox) for which the attacker has remotely configured a malicious Home Page URL via Exchange Web Services or other Exchange access mechanisms. The attacker needs prior access to the victim's Exchange mailbox through compromised credentials, EWS access, or tools like Ruler that abuse legitimate Exchange features. The Outlook Home Page feature must be enabled (default configuration in all affected versions). User interaction is required (UI:R in CVSS) as the victim must launch Outlook and navigate to the compromised folder, but no authentication prompts or security warnings are presented to alert the user. The local attack vector (AV:L) reflects that code execution occurs on the client system, though delivery is remote via Exchange infrastructure. This combination of remote setup capability with local execution makes the vulnerability particularly dangerous in enterprise environments where attackers often have some level of Exchange access.

This is a critical priority vulnerability with convergent risk signals across all assessment frameworks. CISA KEV listing confirms active real-world exploitation in targeted attacks. The 84.64% EPSS score at the 99th percentile indicates exploitation is both widespread and automated. Despite the CVSS 7.8 score categorizing it as 'High' rather than 'Critical', the combination of confirmed exploitation, public POC availability, and the attack requiring only user interaction (UI:R) without authentication (PR:N) makes this extremely dangerous. The CVSS AV:L vector appears inconsistent with the attack scenario described in the SensePost reference, which demonstrates remote delivery via Exchange - this suggests the vulnerability may be locally triggered but remotely exploitable, increasing actual risk beyond the base score. The attack is highly automatable once initial access to Exchange is achieved, and the technical impact provides complete system compromise (C:H/I:H/A:H). Organizations running unpatched Outlook versions face immediate risk from both opportunistic and targeted threat actors.

An attacker with access to the victim's Exchange environment (via compromised credentials or external EWS access) uses the Ruler framework to remotely configure a malicious Home Page URL for the victim's Inbox folder. When the victim opens Outlook and accesses the Inbox, Outlook attempts to render the attacker-controlled Home Page content, triggering the buffer overflow. The overflow allows the attacker to execute arbitrary code with the victim's privileges, enabling installation of malware, credential theft, or lateral movement within the network.