MSRC-CVE-2023-36761 — Microsoft Word Information Disclosure Vulnerability

Summary

Impact: Information Disclosure. Microsoft rating: Important. Exploited according to Microsoft, publicly disclosed before the fix — Exploitation Detected. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of NTLM hashes.

Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A user needs to be tricked into running malicious files.

Security updates
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5413.1000 — https://support.microsoft.com/help/5002497
15.0.5589.1001 — https://support.microsoft.com/help/5002483

Vulnerabilities 1

Medium 6.5

CVE-2023-36761 Exploited EPSS 20%

Microsoft Word Information Disclosure Vulnerability

Microsoft Word Information Disclosure Vulnerability

Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019

Sep 12, 2023
KEV Sep 12, 2023

Revision history

2023-10-17 #2
Updated one or more CVSS scores for the affected products and added an FAQ explaining the vector string settings. This is an informational change only.
2023-09-12 #1
Information published.

References

CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss