Product:
Microsoft Office
Summary
Microsoft Office 2007, 2010, 2013, and 2016 allow an attacker to run arbitrary code in the context of the current user due to improper handling of objects in memory. This vulnerability is known as Microsoft Office Memory Corruption Vulnerability. It poses a significant risk as it can lead to complete compromise of the affected system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-11882 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious document that, when opened by a user, triggers the memory corruption. The attacker can then execute arbitrary code with the same privileges as the user, potentially leading to unauthorized access to sensitive information or system control.
Affected Products
- Microsoft Office 2007 Service Pack 3: Vulnerable to memory corruption issues.
- Microsoft Office 2010 Service Pack 2: Allows arbitrary code execution through crafted documents.
- Microsoft Office 2013 Service Pack 1: Susceptible to exploitation via malicious files.
- Microsoft Office 2016: Can be compromised by opening specially crafted documents.
Mitigation
To mitigate this vulnerability, users should apply the latest updates and patches provided by Microsoft. Regularly updating software can help protect against known vulnerabilities and reduce the risk of exploitation.