Product:
Microsoft Office
Summary
Microsoft Office products including SharePoint and Word allow remote code execution when the software fails to properly handle objects in memory. This vulnerability affects multiple versions of Office and related applications. Attackers can exploit this flaw to execute arbitrary code on the affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-11826 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious document that, when opened by a user, triggers the execution of arbitrary code. The attacker must convince the user to open the document, which can be delivered via email or other means. Successful exploitation can lead to complete control over the affected system.
Affected Products
- Microsoft Office 2010: Affected by remote code execution vulnerability.
- SharePoint Enterprise Server 2010: Vulnerable to improper memory handling.
- Word Viewer: Can be exploited through malicious documents.
- Office Web Apps Server 2010 and 2013: Affected by the same vulnerability.
- Word Automation Services: Vulnerable to remote code execution.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Regularly updating software can help protect against known vulnerabilities and reduce the risk of exploitation.