CVE-2017-8509

HighCVSS 8.8/10Last modified Oct 15, 2026

Description

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft Corporation	Microsoft Office	Microsoft Office 2007 Service Pack 3, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Word 2007, Microsoft Office 2010 Service Pack 2, Microsoft Word 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office Web Apps 2010 Service Pack 2, Microsoft Office Web Apps Server 2013 Service Pack 1, Microsoft Word 2013 RT Service Pack 1, Microsoft OneNote 2010 Service Pack 2, Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, and Microsoft Word 2016

References

http://www.securityfocus.com/bid/98812Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8509Mitigation, Patch, Vendor Advisory
http://www.securityfocus.com/bid/98812Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8509Mitigation, Patch, Vendor Advisory

Timeline

Published: Jun 15, 2017
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-85108.8A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office R CVE-2017-85117.8A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office R CVE-2017-85128.8A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office R CVE-2017-85137.8A remote code execution vulnerability exists in Microsoft PowerPoint when the software fails to properly handle objects in memory, aka "Micr CVE-2017-85145.4An information disclosure vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, a CVE-2017-85155.5Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an unauthenticated attacker to send a specially crafted kernel mode CVE-2017-85167.5Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an info CVE-2017-85177.5Microsoft browsers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G CVE-2017-85187.5Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corru CVE-2017-85197.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 CVE-2017-85207.5Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript s CVE-2017-85217.5Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript s