CVE-2017-11882

CVE-2017-11882 is a significant software vulnerability, specifically a flaw in the design or implementation of Microsoft's Equation Editor. This vulnerability has been exploited by various threat actors to create malicious RTF files, most notably by Chinese state-sponsored groups using the "Royal Road" exploit builder. The Royal Road tool allows these groups to craft documents that take advantage of this vulnerability, among others, to compromise systems. Historically, CVE-2017-11882 has been used to disseminate notorious malware families such as Dridex in 2017 and Guloader in 2021. More recently, Zscaler ThreatLabz reported a campaign exploiting this vulnerability to spread the Agent Tesla information-stealing malware. BlackBerry documented over 9,500 instances of Office documents exploiting this issue since the start of 2024, particularly in organizations with legacy systems often found in ports, maritime facilities, and other critical infrastructure. The threat posed by outdated vulnerabilities like CVE-2017-11882 continues to be discussed by security researchers, including those at Check Point Research. In addition, this vulnerability has been leveraged in various campaigns by TA558, tracked by Palo Alto Networks, Cisco Talos, and Uptycs. These campaigns typically involve malicious Microsoft Word document attachments or remote template URLs to download and install malware, further highlighting the enduring risk associated with this vulnerability.