High severity7.8NVD Advisory· Published Oct 13, 2017· Updated Jun 17, 2026

CVE-2017-11825

Description

Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability".

Affected products

Microsoft/Office
cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*
Microsoft/Office For Mac2 versions
cpe:2.3:a:microsoft:office_for_mac:2016:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:office_for_mac:2016:*:*:*:*:*:*:*
- (no CPE)
Microsoft/Office 2016 Click-to-Run (C2R)llm-fuzzy
Microsoft Corporation/Microsoft Office 2016, Microsoft Office 2016 for Macv5
Range: Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac

Patches

Vulnerability mechanics

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11825nvdPatchVendor Advisory
www.securityfocus.com/bid/101124nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1039539nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.018
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000