Microsoft Office
CVE-2017-11882
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver weaponized Office document via email/web
-
DeliveryUser opens document
-
ExploitEQNEDT32.EXE invoked to render equation
-
InstallBuffer overflow triggered
-
C2Shellcode executes in user context
-
ExecuteDownload second-stage payload
-
ImpactEstablish persistence/C2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires victim to open a specially crafted Office document containing a malicious Equation Editor object. Exploitation succeeds against default Office installations with no special configuration required. The vulnerability triggers during document rendering, so Outlook users with preview pane enabled can be exploited without explicitly opening the attachment. Protected View in Office 2010+ provides defense-in-depth by opening untrusted documents in a sandbox, but users can easily click 'Enable Editing' defeating this control. No authentication required beyond normal file system or email access to deliver the malicious document. Exploitation is NOT limited by: email security gateways (unless specifically scanning for malformed equation objects), macro security settings (no VBA macros involved), or Windows Defender (unless signatures updated). The UI:R designation means user must open the document, making this vulnerable to any social engineering scenario that convinces users to open attachments. |
| Impact | This represents an EXTREME real-world risk despite the CVSS vector showing AV:L (local attack vector). The 'local' designation is misleading - the actual attack vector is network-based delivery of malicious Office documents via email, web download, or shared drives. The EPSS score of 94.38% (100th percentile) combined with CISA KEV status confirms widespread active exploitation across multiple threat actor groups. The UI:R (user interaction required) is minimal - users only need to open a document, which is trivial to achieve via social engineering. Multiple exploit frameworks exist including Metasploit modules and standalone Python tools, making this accessible to low-skill attackers. The SSVC framework would classify this as: Exploitation=Active, Automatable=Yes (via email campaigns), Technical Impact=Total (arbitrary code execution). While patches have been available since November 2017, the vulnerability remains a staple in APT toolkits and ransomware delivery chains targeting organizations with poor patch compliance. The fact that Palo Alto Networks documented in-the-wild exploitation campaigns and third-party vendors released micropatch solutions indicates Microsoft's initial patch had quality issues, further extending the exploitation window. |
| Exploit ScenarioDerived | Attacker crafts a malicious Word document (.doc or .docx) embedding a specially formatted equation object containing shellcode. The document is delivered via spearphishing email with subject lines relevant to the target (e.g., 'Invoice', 'Contract Review'). When the victim opens the document, Office invokes EQNEDT32.EXE to render the equation, triggering the buffer overflow. Shellcode executes with the user's privileges, downloading and executing a second-stage payload (ransomware, remote access trojan, or credential stealer). Multiple Metasploit modules and Python-based exploit generators exist (github.com/embedi/CVE-2017-11882, github.com/0x09AL/CVE-2017-11882-metasploit) allowing rapid weaponization. Palo Alto Unit 42 documented campaigns using this exploit for fileless malware delivery and APT intrusions throughout 2017-2018. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Remote code execution in Microsoft Office 2007-2016 via malicious documents exploiting a 17-year-old buffer overflow in the Equation Editor component (EQNEDT32.EXE). Attackers deliver weaponized Office files that execute arbitrary code when opened, requiring no macros or user interaction beyond opening the document. Confirmed actively exploited (CISA KEV) with EPSS score of 94.38% indicating widespread exploitation. Multiple public exploit frameworks available including Metasploit modules. Microsoft released patches in November 2017, but exploitation continues against unpatched systems across APT campaigns and commodity malware.
Earlier versions of this analysis (1)
A memory corruption vulnerability in the Microsoft Office Equation Editor (EQNEDT32.EXE) allows remote code execution through crafted documents. This 17-year-old component had no ASLR or DEP, making exploitation trivially reliable.
RemediationAI
Apply Microsoft Security Update MS17-11882 released November 14, 2017 via Windows Update or download from Microsoft Update Catalog for Office 2007 (KB4011604), Office 2010 (KB4011604), Office 2013 (KB4011580), and Office 2016 (KB4011574). Microsoft subsequently released KB4011730 in January 2018 which completely removes EQNEDT32.EXE rather than patching it - this is the recommended permanent fix. Organizations unable to patch immediately should block EQNEDT32.EXE execution via AppLocker or Software Restriction Policies with the rule: deny execution of %ProgramFiles%\Microsoft Office\*\EQNEDT32.EXE and %ProgramFiles(x86)%\Microsoft Office\*\EQNEDT32.EXE. Note this breaks legitimate equation editing functionality. Email gateway scanning should flag Office documents containing embedded Equation Editor objects for manual review. Third-party micropatches from 0patch.com provide runtime protection for systems requiring equation editor functionality while awaiting official updates, though this approach trades vendor support for interim security. All compensating controls should be temporary - the only robust solution is applying KB4011730 to remove the vulnerable component entirely.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in EQNEDT32.EXE, the legacy Equation Editor component included with Microsoft Office since Office 97. CWE-119 buffer overflow occurs when parsing specially crafted OLE objects embedded in Office documents (Word, Excel, PowerPoint). The Equation Editor uses the outdated MTEF (Mathematical Type Encoding Format) protocol which lacks proper bounds checking. Attackers embed malicious equation objects containing shellcode that triggers the overflow during document rendering. Because EQNEDT32.EXE runs as a separate process without ASLR or DEP protections, successful exploitation provides reliable code execution in the user context. The affected CPE strings cover Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 across all Windows platforms. This represents a legacy code component that Microsoft initially addressed by removing EQNEDT32.EXE entirely in January 2018 updates after patching proved insufficient.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
Executive ViewAI
CVE-2017-11882 is a remote code execution vulnerability in Microsoft Office 2007-2016 that allows attackers to execute arbitrary code through malicious Office documents without user interaction beyond opening the file. This vulnerability is confirmed actively exploited (CISA KEV) with a 94.4% exploitation probability, posing an immediate risk to any organization using legacy Office versions; unpatched systems remain vulnerable to both targeted APT campaigns and widespread commodity malware attacks.
Apply vendor patch. If immediate patching is not possible: (1) Disable Equation Editor by renaming or removing EQNEDT32.EXE from Office installation directories; (2) Implement file-level execution controls preventing EQNEDT32.EXE from running; (3) Deploy email gateway controls blocking Office documents from external senders or requiring manual approval; (4) Isolate or air-gap systems running unpatched Office from email and untrusted networks until patched.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.