CVE-2024-49033HighCVSS 7.5

Microsoft Word Security Feature Bypass Vulnerability

Published
November 12, 2024
Last Modified
—

🔗 CVE IDs covered (1)

📋 Description

What kind of security feature could be bypassed by successfully exploiting this vulnerability? This vulnerability could allow an attacker to bypass specific functionality of the Office Protected View.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted Word file. In an email attack scenario, an attacker could exploit the vulnerability by sending a link to the specially crafted Word file. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to open the file, typically by way of an enticement in an email or instant message. Then the attacker must convince the victim to open the malicious file.

🎯 Affected products12

  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft Office 2019 for 32-bit editions
  • Microsoft Office 2019 for 64-bit editions
  • Microsoft Office LTSC 2021 for 32-bit editions
  • Microsoft Office LTSC 2021 for 64-bit editions
  • Microsoft Office LTSC 2024 for 32-bit editions
  • Microsoft Office LTSC 2024 for 64-bit editions
  • Microsoft Office LTSC for Mac 2021
  • Microsoft Office LTSC for Mac 2024
  • Microsoft Word 2016 (32-bit edition)
  • Microsoft Word 2016 (64-bit edition)

✅ Remediation

KBRelease Notes (Security Update) — fixed build 16.91.24111020 KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KB5002619 (Security Update) — fixed build 16.0.5474.1000

🔗 References (6)