CVE-2017-11774

Microsoft Corporation Microsoft Outlook

Published 13 Oct 2017 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

References

www.securityfocus.com/bid/101098 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1039542 · Broken Link, Third Party Advisory, VDB Entry
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774 · Patch, Vendor Advisory
sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ · Exploit
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774 · US Government Resource