Critical Remote Code Execution in Microsoft Office (CVE-2017-11826)
What It Is — A remote code execution flaw in Microsoft Office when handling objects in memory, allowing an attacker to execute arbitrary code in the context of the current user.
Exploitability — Publicly disclosed; proof‑of‑concept exploits are circulating; CVSS v3.1 base score 9.8 (Critical).
Affected Products — Microsoft Office 2010, 2013, 2016, 2019, and Microsoft 365 desktop clients.
Why It Matters for Trust & Control Assurance
- Highlights the need for a robust patch‑management control that provides continuous evidence of timely remediation.
- Shows how a single unpatched Office client can break the defensible audit trail required by regulators and enterprise buyers.
- Aligns with the control objective of maintaining up‑to‑date software and timely remediation, which maps to multiple frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2017‑11826 immediately.
- Verify patch rollout across all endpoints and capture deployment logs as audit evidence.
- Incorporate the CVE into your vulnerability‑management workflow and map it to the relevant control objective.
Source: CISA KEV – CVE‑2017‑11826