CVE-2017-11882

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

First PoC 2017-11-20
2773 days →Metasploit 2025-06-23
481 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 99.9%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

2 known · links only

Metasploit1

Microsoft Office CVE-2017-11882 ↗
Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory.
ruby · seen 2026-10-18

Exploit-DB1

Microsoft Office - OLE Remote Code Execution ↗
created 2017-11-20

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Tied by cited sources to

Cobalt
1. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “This adversary incorporated CVE-2017-0199, CVE- 2017-8759 and CVE-2017-11882 into their spear- phishing operations shortly after zero-day.”
  cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17
APT41
1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
APT32
1. “APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Inception Framework
1. “a lure document that exploits CVE-2017-11882, a six-year-old memory corruption flaw in Microsoft Office’s Equation Editor, a technique Cloud Atlas has employed as early as October 2018”
  cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17
2. “Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17
APT23
1. “Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns: Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802 , security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).”
  cited as exploiting · source: blog.trendmicro.com ↗ · 2026-10-17
2. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
SaintBear
1. “Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “The document named Letter Confirm.doc is a CVE-2017-11882 vulnerability document, and the following content is displayed after opening:”
  cited as exploiting · named nearby · source: nsfocusglobal.com ↗ · 2026-10-17
SWEED
1. “In May 2018, campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office”
  cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17
Mysterious Elephant
1. “Initial access is typically achieved through spear-phishing emails carrying weaponized Office documents exploiting CVE-2017-11882.”
  cited as exploiting · named nearby · source: anomali.com ↗ · 2026-10-17
2. “The actor’s early attack chains featured distinctive elements, such as remote template injections and exploitation of CVE-2017-11882 , followed by the use of a downloader called “Vtyrei””
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
GOBLIN PANDA
1. “Distribution of infected samples are often used by attackers such as Goblin Panda through weaponized Microsoft Office documents containing malicious macros, or by exploiting known vulnerabilities—most recently CVE-2012-0158 and CVE-2017-11882.”
  cited as exploiting · source: fortinet.com ↗ · 2026-10-17
Confucius
1. “Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .”
  cited as exploiting · source: trendmicro.com ↗ · 2026-10-17
Tonto Team
1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
OilRig
1. “New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit.”
  attributed by a report · source: attack.mitre.org ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

Metasploit1

Exploit-DB1

On the wire

Watch this one?