CVE-2017-8502

HIGH

Microsoft Excel - Memory Corruption

Title source: rule

Description

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8501.

Exploits (1)

gitlab WRITEUP

by yongchuank · poc

https://gitlab.com/yongchuank/cve-2017-8502-msexcel-protected-view-0E1200-oob

View Code ZIP pw:eip

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/99442

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038851

[Patch, Vendor Advisory] https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8502

Scores

CVSS v3 7.8

EPSS 0.2823

EPSS Percentile 96.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (4)

microsoft/excel 2010 sp2

microsoft/excel 2013 sp1 (2 CPE variants)

microsoft/excel 2016

Microsoft Corporation/Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, and Microsoft Excel 2016. Microsoft Office

Published Jul 11, 2017

Tracked Since Feb 18, 2026