CVE-2017-11882

This vulnerability is like a badly protected toolbox inside Office: when Office tries to handle something in memory, it can be tricked into going the wrong way. If an attacker sends a specially crafted document, opening it may let the attacker run instructions on your computer using the same permissions as the logged-in user. In many cases, this is used as part of phishing emails or other document-based attacks.

This matters to you if your business uses Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, or Microsoft Office 2016 on Windows and those versions are not updated/mitigated. It affects Microsoft’s Office suite itself (not just a niche tool), so it’s relevant to many small offices that edit, receive, or store Office files. The flaw is already being used in the real world as part of ransomware activity (per CISA KEV).

RED: attackers are already exploiting this in the wild, and the likelihood of active exploitation is extremely high. Because the impact is “run arbitrary code” after opening a malicious document, you want to remove exposure as quickly as possible—ideally immediately today, not “sometime this month.”

For the affected Office versions listed (Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016):

• Identify exposure
  • Inventory the computers that run those exact Office products/Service Packs.
  • Confirm whether they have all available Office/security updates installed.
• Patch / upgrade (highest priority)
  • Apply the latest Microsoft Office security updates for the installed version.
  • If the machine is on an end-of-life Office build that cannot receive the needed protection, upgrade Office to a newer supported version.
• Reduce the chance of a malicious file being opened
  • Strengthen Office protections your IT person can configure (for example, Office’s built-in protections around opening files from the internet/untrusted locations).
  • Tighten email and file sharing practices: discourage opening unexpected attachments and verify document senders.
• Monitor and respond
  • Ensure endpoint protections (anti-malware/EDR) are enabled and reporting.
  • Watch for signs of Office-launched suspicious processes or repeated alerts around Office document handling.
  • If you suspect compromise from an email/document, isolate the affected machine and start incident response with your IT support.

Reasoning based on the facts you provided: this CVE is known to be exploited in the wild (including ransomware usage per CISA KEV) and public exploitation is available, so patching/upgrade is the most reliable path to closing the risk.

CVE-2017-11882 is a Microsoft Office “Memory Corruption” issue ("fails to properly handle objects in memory"). The practical impact is arbitrary code execution in the context of the current user, typically triggered by a malicious Office document.

Key points from your provided context:

• Known exploited in the wild (CISA KEV): yes (used in ransomware).
• Exploitation status from press: itw.
• Public exploit available: yes.
• EPSS: 99.9% estimated probability of exploitation in the next 30 days.

Attack vector (high level): deliver a crafted Office file to a user; when the file is opened, Office fails during memory/object handling and attacker-controlled code can run under the logged-in user.

Relatedness: This CVE is unique from CVE-2017-11884 (separate issue).

About EPSS and CISA KEV (in plain terms): EPSS is a model estimating how likely exploitation is soon; KEV means CISA has added it to a list of actively exploited vulnerabilities, which strongly increases the expectation that real attackers will target it.