Actively exploited · Published Sep 10, 2024 · Assigned by microsoft
CVE-2024-38226Microsoft Publisher Security Feature Bypass Vulnerability
High 7.3 Exploited
In plain English
A high-severity security flaw in Microsoft Office 2019 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on September 10, 2024). The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 1, 2024.
Official description
Microsoft Publisher Security Feature Bypass Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Office 2019 | 19.0.0 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Publisher 2016 | 16.0.0 – before 16.0.5465.1001 |
Weakness: CWE-693 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
References
- Microsoft Publisher Security Feature Bypass Vulnerability vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38226 government-resource