CVE-2017-11884: Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run arbitrary code in the context of the curr...

Security readout for executives and security teams

CVE-2017-11884 is a Microsoft Excel 2016 Click-to-Run memory corruption flaw. A malicious document could cause code to run as the current user. The bundle does not provide CVSS, public exploit evidence, or detailed patch text, so urgency depends on affected asset presence and Microsoft guidance. Exposure is limited to environments running Microsoft Excel 2016 Click-to-Run. Risk is higher on endpoints that receive or open untrusted Office documents. The source bundle does not identify other Office versions or platforms as affected. Treat as a high-priority legacy Office exposure if Excel 2016 C2R remains deployed. Arbitrary code execution in a user context can support compromise through malicious documents, but available evidence does not show known active exploitation. Mitigation focus: Inventory endpoints for Microsoft Excel 2016 Click-to-Run installations.; Review the Microsoft MSRC advisory for applicable security updates or vendor mitigations.; Prioritize affected endpoints that process external Office attachments..

Prepared

Jun 12, 2026, 20:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.