Heap-based Buffer Overflow (CWE-122)
A remote code execution vulnerability exists in Microsoft Office Visio. This vulnerability is classified as a heap-based buffer overflow (CWE-122). The vulnerability affects Microsoft Office Long Term Servicing Channel 2021, Microsoft 365 Apps for Enterprise, and Microsoft Office 2019.
If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with the same privileges as the current user. Given the high confidentiality, integrity, and availability impacts, a successful attack could potentially lead to unauthorized access to sensitive information, modification of data, or disruption of system availability. The attack requires user interaction and can be initiated from a local vector, which somewhat limits its scope but doesn't diminish its severity.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available for this vulnerability. Microsoft released security updates on August 13, 2024, to address this issue.
1. Apply the security updates provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users operate with minimal necessary permissions. 3. Educate users about the risks of opening untrusted files or clicking on suspicious links, as user interaction is required for exploitation. 4. Consider implementing application whitelisting to prevent unauthorized executables from running. 5. Regularly update and patch all Microsoft Office products, especially Visio. 6. Monitor systems for any suspicious activities that might indicate exploitation attempts.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
A CVSS base score of 7.8 has been assigned.
Feedly found the first article mentioning CVE-2024-38169. See article
NVD published the first details for CVE-2024-38169
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 21.2%)