Netskope Threat Labs

CVE-2017-11882

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

This detection identifies exploitation attempts targeting CVE-2017-11882, which has a HIGH severity rating. Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow a cyberattacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka Microsoft Office Memory Corruption Vulnerability. This CVE ID is unique from CVE-2017-11884.

Stats

First seen
January 2022
Last seen
October 2026

CVEs

CVE-2017-11882

Alert name variants

Alert Name
Binary.Exploit.CVE-2017-11882
ByteCode-MSIL.Exploit.CVE-2017-11882
Document-Excel.Exploit.CVE-2017-11882
Document-HTML.Exploit.CVE-2017-11882
Document-Multimedia.Exploit.CVE-2017-11882
Document-Office.Exploit.CVE-2017-11882
Document-OLE.Exploit.CVE-2017-11882
Document-PDF.Exploit.CVE-2017-11882
Document-RTF.Exploit.CVE-2017-11882
Document-Word.Downloader.CVE-2017-11882

Related IPS Signatures

Signature Name
FILE-OFFICE Microsoft Office Equation Editor object stack buffer overflow attempt
FILE-OFFICE Microsoft Office Equation Editor object with automatic execution embedded in RTF attempt
FILE-OFFICE Microsoft Office Equation Editor Package objclass RTF evasion attempt
FILE-OFFICE Microsoft Office Equation Editor RTF embedded OLE evasion attempt
FILE-OFFICE Microsoft Office Equation Editor stack buffer overflow attempt
FILE-OFFICE Microsoft Office None type objclass RTF evasion attempt
OS-WINDOWS Shellcode injection into Microsoft Office Equation Editor process attempt

Related blogs

Related families

OverlayMicrosoftShellcodeWarzoneRATXLoader

References