CVE-2017-11882 Microsoft Office
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
- CVSS
- not scored
On CISA’s exploited list
Microsoft Office Memory Corruption Vulnerability
- Added
- 2021-11-03
- Federal patch deadline
- 2022-05-03
- Ransomware use
- known
Actors known to use it (MITRE ATT&CK)
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium · 37 techniques
- Tropic TrooperPirate Panda, KeyBoy · 35 techniques
- PatchworkHangover Group, Dropping Elephant, Chinastrats · 34 techniques
- Cobalt GroupGOLD KINGSWOOD, Cobalt Gang, Cobalt Spider · 26 techniques
- SidewinderIndia · T-APT-04, Rattlesnake · 23 techniques
- InceptionInception Framework, Cloud Atlas · 20 techniques
- ConfuciusConfucius APT · 16 techniques
- BITTERT-APT-17 · 16 techniques
- Tonto TeamChina · Earth Akhlut, BRONZE HUNTLEY, CactusPete · 14 techniques
- Saint BearRussia · Storm-0587, TA471, UAC-0056 · 13 techniques