CVEvulnerability

CVE-2017-11774

7.8 HIGH Known exploited Published 2017-10-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Office Outlook Security Feature Bypass Vulnerability — Microsoft Office

Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.

Added to KEV: 2021-11-03
Remediation due: 2022-05-03
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-11774

Status: Analyzed
Published: 2017-10-13
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses: CWE-119

Description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Affected configurations

• microsoft outlook 2010 • microsoft outlook 2013 • microsoft outlook 2016

Weakness · CWE (1)

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References