CVE-2017-11774: Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 a

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, ak

Status

Published

2017-10-13

Updated

2025-10-21

Assigning organization

microsoft

Description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Microsoft Corporation Microsoft Outlook

Microsoft Outlook 2010 SP2affected
Outlook 2013 SP1 and RT SP1affected
Outlook 2016affected

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774 ↗
http://www.securityfocus.com/bid/101098 ↗
http://www.securitytracker.com/id/1039542 ↗
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/ ↗
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774 ↗