ZeroDay Findings
Sign inSign up

Findings

CVE-2017-11774

Microsoft Office Outlook Security Feature Bypass Vulnerability

Published Oct 13, 2017 · updated Jun 16, 2026 · microsoft outlook

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2017 · Catalog

    Detected

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe microsoft/outlook2010
  • cpe microsoft/outlook2013
  • cpe microsoft/outlook2016
  • vendor Microsoft Officeversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2017-11774

    Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2017-11774

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-11774

    30-day exploitation probability 59.6%

    first.org
  • NIST NVDVulnerability recordCVE-2017-11774

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

    nvd.nist.gov

References