7.8High KEV

CVE-2017-11774Microsoft Office Outlook Security Feature Bypass Vulnerability

Microsoft Corporation Microsoft Outlook Published: 2017-10-13 16:00 (9 years ago)

Known exploited — Microsoft Office Outlook Security Feature Bypass Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-11774

Description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Weakness (CWE): CWE-119

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft Corporation	Microsoft Outlook	Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, Outlook 2016
microsoft	outlook	2010

References and patches

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774 PatchVendor Advisory
101098 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
1039542 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774 US Government Resource

CPE matches (NVD) (4)

cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*

CVSS score

7.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	7.8High
nvd	CVSS 3.1	7.8High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8High
nvd	CVSS 2.0	6.8Medium

EPSS (chance of exploitation in 30 days)

59.63%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2017-07-31
Published2017-10-13 16:00
Reached IP-DB2026-10-24 23:35
Added to KEV2021-11-03
Last updated2026-06-17 04:02

Assigned by (CNA): microsoft
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Microsoft Office / 365 Apps

6.5Medium

CVE-2026-108454 17 days ago

Microsoft Office PowerPoint Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

6.5Medium

CVE-2026-108455 17 days ago

Microsoft Office PowerPoint Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

6.5Medium

CVE-2026-108453 17 days ago

Microsoft Office PowerPoint Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

8.8High

CVE-2026-108450 17 days ago

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

8.8High

CVE-2026-108451 17 days ago

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

8.8High

CVE-2026-108449 17 days ago

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Microsoft 365 Apps for Enterprise; Microsoft Microsoft Office 365 for Mac; Microsoft Microsoft Office LTSC 2021; Microsoft Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.