Loading vulnerability…
Microsoft Office Equation Editor Stack Buffer Overflow RCE
CVE-2017-11882 is a stack-based buffer overflow in the legacy Microsoft Equation Editor component used by Microsoft Office. Insufficient bounds checking during equation font-name processing permits a specially crafted embedded equation object to corrupt stack memory and execute arbitrary code with the privileges of the user opening the document. Affected products include Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, and Office 2016, including applicable 32-bit and 64-bit editions. Exploits can be delivered through malicious RTF documents or Office documents that embed or retrieve RTF content. Word's altChunk feature and remote template injection can route malicious content to the vulnerable component but are not themselves the underlying vulnerability. Microsoft released a security update in November 2017.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of resources accessible to the current user. Attackers can execute commands, install malware, steal or modify accessible data, and establish user-level persistence through subsequent payloads. If the victim has administrative privileges, exploitation can enable full system control, including installing programs, destroying data, and creating accounts. Observed exploitation has delivered information stealers and remote-access malware, including Agent Tesla, FormBook, XLoader, Remcos, and PortDoor. The vulnerability does not independently grant privileges beyond those of the victim.
If you can’t patch tonight, do this now.
Until remediation is complete, disable the legacy Microsoft Equation Editor COM component using Microsoft's documented registry-based workaround. EMET or Windows Defender Exploit Guard protections for Equation Editor, or system-wide ASLR, can impede known exploitation techniques but do not replace patching. Use non-administrative accounts for document handling, filter suspicious Office and RTF attachments, and avoid opening unexpected documents without independent verification. Monitor document-triggered script execution and persistence changes, and deploy endpoint protections capable of detecting exploitation.
Patch, then assume compromise.
Apply Microsoft's security updates addressing CVE-2017-11882 to every affected Office installation. Verify deployment across affected Office versions and architectures rather than relying on the installed service-pack level alone. Upgrade affected installations to a supported, patched Office release where necessary.
12 exploits validated by Mallory's analysis. Hidden: 6 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
284 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.