CVE-2017-11826

Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.

Affected products

Office, Office Online Server, Office Web Apps Server, Office Word, Sharepoint Server, Word Automation Services, Word Viewer

Microsoft Office Compatibility Pack

All versions

Microsoft Office Online Server

= 2016

Microsoft Office Web Apps Server

= 2010, 2013

Microsoft Office Word Viewer

All versions

Microsoft Sharepoint Enterprise Server

= 2016

Microsoft Sharepoint Server

= 2010, 2013

Fix

Available

CVSS 2.0

9.3 HIGH

CVSS 3.1

7.8 HIGH

EPSS

81.5% (100th percentile)

Weakness

CWE-119

NVD status

Analyzed

Published

2017-10-13