Zero-day vulnerability in Microsoft Office

Memory corruption

The weakness was reported to Microsoft by researchers at China-based security firm Qihoo 360. The experts said they first observed an attack exploiting this vulnerability on September 28. The attacks targeted a small number of the companyтАЩs customers and they involved malicious RTF files.

Vulnerability details

Advisory: SB2017101001 - Remote code execution in Microsoft Office

Vulnerable component: Microsoft Office

CVE-ID: CVE-2017-11826

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious content. A remote attacker can send a specially crafted .doc file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Note: the vulnerability is being actively exploited.