CVE-2017-11882

This vulnerability is like a badly protected toolbox inside Office: when Office tries to handle something in memory, it can be tricked into going the wrong way. If an attacker sends a specially crafted document, opening it may let the attacker run instructions on your computer using the same permissions as the logged-in user. In many cases, this is used as part of phishing emails or other document-based attacks.

This matters to you if your business uses Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, or Microsoft Office 2016 on Windows and those versions are not updated/mitigated. It affects Microsoft’s Office suite itself (not just a niche tool), so it’s relevant to many small offices that edit, receive, or store Office files. The flaw is already being used in the real world as part of ransomware activity (per CISA KEV).

RED: attackers are already exploiting this in the wild, and the likelihood of active exploitation is extremely high. Because the impact is “run arbitrary code” after opening a malicious document, you want to remove exposure as quickly as possible—ideally immediately today, not “sometime this month.”