CVE-2017-11882

HIGH KEV RANSOMWARE

Microsoft Office CVE-2017-11882

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2017-11882 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 51 public exploits from researchers including embedi, Ridter, rip1s, including a Metasploit module exploits/windows/fileformat/office_ms17_11882.

AI-analyzed exploit summary This PoC exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor, to trigger command execution via a crafted RTF file. It leverages WebDav to execute arbitrary binaries from a remote attacker-controlled server.

Description

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

Exploits (51)

exploitdb WORKING POC
by embedi · textremotewindows
https://www.exploit-db.com/exploits/43163

This PoC exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor, to trigger command execution via a crafted RTF file. It leverages WebDav to execute arbitrary binaries from a remote attacker-controlled server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable Microsoft Office installation · Network access to attacker-controlled WebDav server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 538 stars
by Ridter · client-side
https://github.com/Ridter/CVE-2017-11882

This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers remote code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 496 stars
by embedi · client-side
https://github.com/embedi/CVE-2017-11882

This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via a WebDAV server to bypass command length limitations.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable Microsoft Office installation · Network access to a WebDAV server controlled by the attacker
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 331 stars
by rip1s · local
https://github.com/rip1s/CVE-2017-11882

This is a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 272 stars
by rxwx · client-side
https://github.com/rxwx/CVE-2018-0802

This repository contains a Python-based exploit for CVE-2018-0802, which leverages the Packager OLE object to drop and execute a payload via an RTF file. The exploit can also chain CVE-2017-11882 for additional impact.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 167 stars
by Ridter · client-side
https://github.com/Ridter/RTF_11882_0802

This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office. The exploit leverages a vulnerability in the Equation Editor to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Python environment · Target system with vulnerable Microsoft Office installation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 97 stars
by 0x09AL · client-side
https://github.com/0x09AL/CVE-2017-11882-metasploit

This is a Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office Word (vulnerable versions)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 44 stars
by starnightcyber · client-side
https://github.com/starnightcyber/CVE-2017-11882

This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 35 stars
by BlackMathIT · client-side
https://github.com/BlackMathIT/2017-11882_Generator

This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 11 stars
by likekabin · client-side
https://github.com/likekabin/CVE-2018-0802_CVE-2017-11882

This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office Equation Editor. The script embeds arbitrary commands into the RTF file, which execute upon opening in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office with unpatched Equation Editor · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 6 stars
by Retr0-code · client-side
https://github.com/Retr0-code/SignHere

This repository contains a Python-based exploit for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. It generates malicious RTF documents with embedded commands to execute payloads via VBScript or PowerShell, leveraging the Equation Editor flaw.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016
No auth needed
Prerequisites: Python 3 · Network access to host payloads
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 5 stars
by littlebin404 · client-side
https://github.com/littlebin404/CVE-2017-11882

This repository contains a working proof-of-concept exploit for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, affecting Office versions 2003 to 2016.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office 2003-2016
No auth needed
Prerequisites: Victim must open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 3 stars
by zhouat · poc
https://github.com/zhouat/cve-2017-11882

The repository contains only a README.md file with a CVE identifier and no exploit code or technical details. It appears to be a placeholder or stub for CVE-2017-11882.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Microsoft Office (CVE-2017-11882)
No auth needed
Prerequisites: none
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by ekgg · poc
https://github.com/ekgg/Overflow-Demo-CVE-2017-11882

This repository contains a proof-of-concept for CVE-2017-11882, demonstrating a stack-based buffer overflow vulnerability. The code includes a GUI and a console application to trigger the overflow by loading a maliciously crafted file.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office Equation Editor (EQNEDT32.EXE)
No auth needed
Prerequisites: A maliciously crafted file to trigger the buffer overflow
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 2 stars
by ChaitanyaHaritash · poc
https://github.com/ChaitanyaHaritash/CVE-2017-11882

This repository is a stub that redirects to another repository for the actual exploit code. It contains no functional exploit code or technical details.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Microsoft Office (CVE-2017-11882)
No auth needed
Prerequisites: none
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Shadowshusky · client-side
https://github.com/Shadowshusky/CVE-2017-11882-

This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that can execute arbitrary commands when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 1 stars
by Abdibimantara · poc
https://github.com/Abdibimantara/Maldoc-Analysis

This repository contains a writeup discussing malware samples exploiting CVE-2017-11882 and CVE-2018-0802, specifically targeting Microsoft Office files. No exploit code is provided, only a description of the malware and its association with the vulnerabilities.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Microsoft Office (unspecified version)
No auth needed
Prerequisites: Malicious Office document
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Sunqiz · client-side
https://github.com/Sunqiz/CVE-2017-11882-reproduction

This repository contains a Python-based proof-of-concept exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by tzwlhack · remote
https://github.com/tzwlhack/CVE-2017-11882

This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by DONKEY0xSHOT · poc
https://github.com/DONKEY0xSHOT/CVE-2017-11882-Blocker

This repository contains a functional kernel-mode driver designed to block the exploitation of CVE-2017-11882 by monitoring process creation events and denying child processes spawned by 'eqnedt32.exe'. The driver uses a cancel-safe queue (CSQ) for IRP handling and a process notification callback to intercept and block malicious process trees.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office Equation Editor (eqnedt32.exe)
No auth needed
Prerequisites: Kernel-mode execution privileges · Target system running vulnerable Microsoft Office Equation Editor
devstral-2 · analyzed Apr 26, 2026 Full analysis →
gitlab WORKING POC
by Gaojianli · poc
https://gitlab.com/Gaojianli/CVE-2017-11882

This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by imkidz0 · client-side
https://github.com/imkidz0/CVE-2017-11882

This repository contains a Python-based PoC for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands via a crafted OLE object.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Victim must open the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by xdrake1010 · poc
https://github.com/xdrake1010/CVE-2017-11882-Preventer

This repository contains a Chrome extension designed to detect DOCX files exploiting CVE-2017-11882 by analyzing embedded Equation Editor objects and suspicious font name lengths. It uses JSZip to parse DOCX files as ZIP archives and checks for malicious indicators.

Classification
Scanner 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Chrome browser · DOCX file download
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by lisinan988 · client-side
https://github.com/lisinan988/CVE-2017-11882-exp

This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by chanbin · client-side
https://github.com/chanbin/CVE-2017-11882

This Python script generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution when the RTF is opened.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Victim opens the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by j0lama · remote
https://github.com/j0lama/CVE-2017-11882

This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by likekabin · poc
https://github.com/likekabin/CVE-2017-11882

This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands (up to 109 bytes) via a crafted OLE object.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: Victim must open the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by CSC-pentest · poc
https://github.com/CSC-pentest/cve-2017-11882

The repository contains only a README.md file with minimal content, lacking any exploit code or technical details for CVE-2017-11882. No functional PoC, scanner, or writeup is present.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Microsoft Office (unspecified version)
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Grey-Li · remote
https://github.com/Grey-Li/CVE-2017-11882

This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by HZachev · poc
https://github.com/HZachev/ABC

The repository contains a README.md file referencing CVE-2017-11882 with links to Invoke-Mimikatz and a calc.exe payload, but lacks actual exploit code or technical details. It appears to be a placeholder or incomplete writeup.

Classification
Writeup 30%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Office (unspecified version)
No auth needed
Prerequisites: none specified
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC MANUAL
by mumbai, embedi · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb

This Metasploit module exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor that allows arbitrary code execution via maliciously crafted RTF files. The exploit generates an RTF file with an embedded OLE object to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Victim opens the malicious RTF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
patchapalooza WORKING POC
by j4_son · poc
https://gitee.com/j4_son/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, targeting Office versions 2003-2016.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (2003-2016)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by mirrors_embedi · poc
https://gitee.com/mirrors_embedi/CVE-2017-11882

This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable Microsoft Office installation · WebDAV server controlled by attacker
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by mirrors_unamer · poc
https://gitee.com/mirrors_unamer/CVE-2017-11882

This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE component. The exploit generates malicious RTF files that execute arbitrary shellcode or commands via a stack-based buffer overflow, with support for process injection to avoid crashing the target application.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites: vulnerable Microsoft Office installation · ability to deliver malicious RTF file to target
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by csharphpython · poc
https://gitee.com/csharphpython/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by adai2022 · poc
https://gitee.com/adai2022/CVE-2017-11882

This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that can execute arbitrary commands or shellcode, with support for process injection to avoid crashing the target application.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites: vulnerable Microsoft Office installation · ability to deliver malicious RTF file to target
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by zhangbo123321 · poc
https://gitee.com/zhangbo123321/CVE-2017-11882-metasploit

This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office Word (with vulnerable Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by aston_mation · poc
https://gitee.com/aston_mation/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The scripts generate malicious RTF files that execute arbitrary commands when opened.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by putiji · poc
https://gitee.com/putiji/CVE-2017-11882-17k

This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that triggers remote code execution via a crafted payload, with support for both command execution and shellcode injection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites: vulnerable Microsoft Office installation · user interaction to open malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by putiji · poc
https://gitee.com/putiji/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands (e.g., calc.exe) when opened in vulnerable versions of Microsoft Office.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by wu_ze_jun · poc
https://gitee.com/wu_ze_jun/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by xiaolouuu · poc
https://gitee.com/xiaolouuu/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by alessio_ · local
https://gitlab.com/alessio_/CVE-2017-11882

This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites: WebDAV server controlled by attacker · Victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by chenM1020 · poc
https://gitee.com/chenM1020/CVE-2017-11882

This repository contains functional exploit code for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. The provided Python scripts generate malicious RTF files that execute arbitrary commands via crafted OLE objects.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office (Equation Editor)
No auth needed
Prerequisites: victim opens malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by chenM1020 · poc
https://gitee.com/chenM1020/CVE-2017-11882-metasploit

This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Office Word (with vulnerable Equation Editor)
No auth needed
Prerequisites: Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (15)

Core 15
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/embedi/CVE-2017-11882
Exploit, Third Party Advisory x_refsource_misc
https://github.com/unamer/CVE-2017-11882
Exploit, Third Party Advisory x_refsource_misc
https://github.com/rxwx/CVE-2017-11882
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101757
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039783
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/421280
Exploit, Patch, Third Party Advisory x_refsource_misc
https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/0x09AL/CVE-2017-11882-metasploit
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43163/

Scores

CVSS v3 7.8
EPSS 0.9435
EPSS Percentile 100.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2017-11-27
InTheWild.io 2021-07-23
ENISA EUVD EUVD-2017-3478
Ransomware Use Confirmed
CWE
CWE-119
Status published
Products (5)
microsoft/office 2007 sp3
microsoft/office 2010 sp2
microsoft/office 2013 sp1
microsoft/office 2016
Microsoft Corporation/Microsoft Office Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Se
Published Nov 15, 2017
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026