CVE-2017-11882Vulnerability
Microsoft Office Memory Corruption Vulnerability
Reported by 4 independent sources · first reported by Group-IB · last reported
Last reported 23 days ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 14 Oct 2026
What the reports say
7 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“CVE-2017-11882 (23,5% del total de exploits): : La persistente vulnerabilidad de corrupción de memoria en Microsoft Equation Editor, extendida de manera uniforme en la región.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“CVE-2017-11882: Representó el 1,93% del total nacional de amenazas, confirmando que componentes de Microsoft Office sin actualizar continúan operando activos en redes locales.”
-
Exploits and vulnerabilities in Q2 2026“CVE-2017-11882: another RCE vulnerability also affecting Equation Editor”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2017-11882”
-
Nice Try Tonto Team“The tool allows the threat actor to create malicious RTF exploits with plausible decoy content for CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798, which are the vulnerabilities in the Microsoft Equation Editor.”
-
Kremlin RATs from Nigeria“Most of these files are RTF documents that exploit the CVE-2017-11882 vulnerability, while others are the executable payload.”
-
When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection“On November 14, 2017, specialists from Embedi published a technical report about CVE-2017-11882 vulnerability and demonstrated it in various versions of Microsoft Office products.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2017-0199, CVE-2018-0802, CVE-2023-38831, CVE-2023-36884, CVE-2026-43284, CVE-2025-8088, CVE-2025-6218, CVE-2026-31431, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-43494, CVE-2026-46331, CVE-2022-0847, CVE-2019-13272, CVE-2021-22555, CVE-2023-32233, CVE-2026-35273, CVE-2023-46604, CVE-2024-12356
Thanks — we review every report.