Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This vulnerability bypasses OLE mitigations in Microsoft 365 and Microsoft Office which protect users from vulnerable COM/OLE controls.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file.
How could an attacker exploit this vulnerability?
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user.
Security updates
10.0.17763.5820 — https://support.microsoft.com/help/5037765
10.0.20348.2461 — https://support.microsoft.com/help/5037782
10.0.20348.2458 — https://support.microsoft.com/help/5037848
10.0.22000.2960 — https://support.microsoft.com/help/5037770
10.0.19044.4412 — https://support.microsoft.com/help/5037768
10.0.22621.3593 — https://support.microsoft.com/help/5037771
10.0.25398.887 — https://support.microsoft.com/help/5037781
10.0.10240.20651 — https://support.microsoft.com/help/5037788
10.0.14393.6981 — https://support.microsoft.com/help/5037763
Vulnerabilities 1
-
High 8.8CVE-2024-30040 Exploited
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
KEV May 14, 2024
Revision history
-
#1
Information published.
References
-
CVE-2024-30040 Windows MSHTML Platform Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss