CVE-2017-11774

Microsoft Outlook Security Feature Bypass Vulnerability

CVE-2017-11774 is fixed in 7 products on 1 platform, first by KB4011196, released October 10, 2017. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. Patch Radar priority: Patch now.

Patch nowCISA KEV
CVSS
n/a
Important
Exploitation
Exploited
Listed by CISA
CISA KEV
Nov 3, 2021
Federal due date May 3, 2022
EPSS
0.5963
99th percentile

<p>A security feature bypass vulnerability exists when Microsoft Outlook improperly handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary commands.</p> <p>In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability, and then convince users to open the document file and interact with the document.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Outlook handles objects in memory.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Microsoft Outlook 2010 Service Pack 2 (32-bit editions) KB4011196 Oct 10, 2017
Microsoft Outlook 2010 Service Pack 2 (64-bit editions) KB4011196 Oct 10, 2017
Microsoft Outlook 2013 RT Service Pack 1 KB4011178 Oct 10, 2017
Microsoft Outlook 2013 Service Pack 1 (32-bit editions) KB4011178 Oct 10, 2017
Microsoft Outlook 2013 Service Pack 1 (64-bit editions) KB4011178 Oct 10, 2017
Microsoft Outlook 2016 (32-bit edition) KB4011162 Oct 10, 2017
Microsoft Outlook 2016 (64-bit edition) KB4011162 Oct 10, 2017