Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2017-8509

CVE-2017-8509HIGH

Microsoft Corporation Microsoft Office — A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Offic…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .1824   97.2     —

AFFECTED
  Product           Versions                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Fixed
  Microsoft Office  Microsoft Office 2007 Service Pack 3, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Word 2007, Microsoft Office 2010 Service Pack 2, Microsoft Word 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office Web Apps 2010 Service Pack 2, Microsoft Office Web Apps Server 2013 Service Pack 1, Microsoft Word 2013 RT Service Pack 1, Microsoft OneNote 2010 Service Pack 2, Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, and Microsoft Word 2016 –  —

TIMELINE
  May 3   Reserved by microsoft
  Jun 15  Published (CNA: microsoft)
  Oct 15  ENRICHED — CVE-2017-8509 (Microsoft Corporation Microsoft Office). Received CVSS 8.8 and CPE data from NVD.

CNA: microsoft · CVSS v3.0 · 2 references · NVD status: Modified

Description

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 3, 2017	Reserved	Reserved by microsoft
June 15, 2017	Published	Published (CNA: microsoft)
October 15, 2026	ENRICHED	ENRICHED — CVE-2017-8509 (Microsoft Corporation Microsoft Office). Received CVSS 8.8 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Microsoft Corporation	Microsoft Office	—	Microsoft Office 2007 Service Pack 3, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Word 2007, Microsoft Office 2010 Service Pack 2, Microsoft Word 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office Web Apps 2010 Service Pack 2, Microsoft Office Web Apps Server 2013 Service Pack 1, Microsoft Word 2013 RT Service Pack 1, Microsoft OneNote 2010 Service Pack 2, Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, and Microsoft Word 2016	—

References (2)

http://www.securityfocus.com/bid/98812 [Third Party Advisory, VDB Entry]
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8509 [Mitigation, Patch, Vendor Advisory]

Authoritative record: CVE-2017-8509 at cve.org

Vendors: microsoft

About this page