CVE-2017-11774highunder attackCWE-119

CVE-2017-11774: high-severity vulnerability in Microsoft Outlook

Published · Updated

Follow this CVE+ Monitor Microsoft Office+ Monitor Microsoft Outlook

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 2 threat group(s) use it.

ssvc Actcvss 7.8epss 60%
from disclosure to weapon672 days
Published on NVDOct 13
1st PoC+672d
CISA KEV+1482d
Who exploits it — 2

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT33🇮🇷 MITRE ATT&CK
APT / StateOilRig🇮🇷 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Microsoft Outlook versions 2010, 2013, and 2016 have a flaw that allows attackers to run malicious commands by exploiting how the application handles objects in memory. This bypasses security protections that normally block such attacks.

Technical detail

The vulnerability exists in Microsoft Outlook's memory object handling mechanism, allowing attackers to bypass security features and achieve arbitrary command execution. Exploitation requires crafted input delivered through Outlook, with impact limited by the privileges of the affected user account. CWE-119 (Buffer Overflow) is the underlying memory safety issue enabling the bypass.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Microsoft Outlook
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Outlook

In the same product, most dangerous first.

CVE-2018-0793—CVE-2018-0793EPSS 20.6%CVE-2018-0791—CVE-2018-0791EPSS 20.6%CVE-2017-11776—CVE-2017-11776EPSS 9.4%CVE-2018-0850—CVE-2018-0850EPSS 5.0%