Loading story…
CVE-2017-11882 is a Microsoft Office memory corruption flaw in the legacy Equation Editor that enables arbitrary code execution in the context of the current user when a victim opens a crafted document. The vulnerability affects Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, and Office 2016, and public exploit material quickly emerged showing how malicious RTF files could trigger remote command execution or shellcode execution, including Metasploit support and techniques that leveraged mshta.exe or injected payloads into EQNEDT32.EXE.
The flaw was also used in phishing operations to deliver malware. One documented campaign used malicious Office documents exploiting CVE-2017-11882 alongside CVE-2017-0199 to deploy the LokiBot stealer through a multi-stage chain involving encrypted Excel files, embedded OLE objects, and follow-on document retrieval. Investigation of the campaign exposed misconfigured attacker infrastructure, including a publicly accessible phpinfo.php page on 192.3.239.42, a host identified as WIN-2NF07F1AQLT, and OSINT links to additional infrastructure and Brazil-registered scam domains tied to the operation.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2017-11882 was updated, with the entry continuing to note advisory, CERT, exploit, and in-the-wild research references. The update did not change the core description of the Microsoft Office memory corruption flaw.
A GitHub repository published a proof of concept named webdav_exec for CVE-2017-11882 that generated a malicious document using OLE objects for sequential command execution. The technique used a UNC path and WebDAV to start the WebClient service and launch an attacker-controlled executable from a remote server, bypassing command-length limitations.
Trend Micro disclosed a malicious RTF document exploiting CVE-2017-11882 to launch an HTA file, invoke PowerShell, and retrieve the Loki spyware payload. The report also said other actors were using the flaw in spam campaigns to distribute malware including Pony/FAREIT, FormBook, ZLoader, and Ursnif.
A GitHub repository published a Metasploit module and RTF template for exploiting CVE-2017-11882, based on a public Embedi proof of concept. The module used mshta.exe to execute the payload.
Unit 42 reported active in-the-wild exploitation of CVE-2017-11882 and said that since November 20 it had seen thousands of attack attempts. The researchers described a Europe-targeted fake invoice campaign in which a malicious Office document used the flaw to launch mshta and ultimately download the FormBook information stealer.
CVE-2017-11882 was published as a Microsoft Office memory corruption vulnerability that can allow arbitrary code execution in the context of the current user. The record identifies affected Office versions including Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016.
Microsoft published its Security Update Guide entry for CVE-2017-11882, describing a Microsoft Office memory corruption vulnerability that could lead to remote code execution when a user opens a specially crafted file. Microsoft said the flaw was not publicly disclosed or exploited at original publication and that the update fixed how the affected component handled objects in memory.
Investigation of the LokiBot campaign found a publicly accessible phpinfo.php page on 192.3.239.42 that exposed the hostname WIN-2NF07F1AQLT and a Windows Server 2016 environment. OSINT linked the hostname to additional malicious infrastructure and to Brazil-registered domains Webcamer.com.br and Citydesconto.com.br.
Researchers described a phishing campaign using malicious Office documents that exploited CVE-2017-0199 and CVE-2017-11882 to deliver the LokiBot stealer. The lure impersonated Romania's ANAF and led victims through a multi-stage chain ending with download of vbc.exe from attacker infrastructure.
A GitHub exploit repository documented a Python-based CVE-2017-11882 exploit that could generate crafted RTF files for command execution or shellcode delivery, supporting payloads of roughly 17 KB. The write-up also described optional shellcode injection into a new EQNEDT32.EXE process.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 81 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecybergeeks.tech
Open sourceexploit-db.com
Open sourcemsrc.microsoft.com
Open sourceblog.trendmicro.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026