Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This vulnerability could allow an attacker to bypass specific functionality of the Office Protected View.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user open a specially crafted Word file.
In an email attack scenario, an attacker could exploit the vulnerability by sending a link to the specially crafted Word file.
An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to open the file, typically by way of an enticement in an email or instant message. Then the attacker must convince the victim to open the malicious file.
Security updates
16.91.24111020 — https://go.microsoft.com/fwlink/p/?linkid=831049
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5474.1000 — https://support.microsoft.com/help/5002619
Vulnerabilities 1
-
High 7.5
Microsoft Word Security Feature Bypass Vulnerability
Microsoft Word Security Feature Bypass Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2024-49033 Microsoft Word Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49033
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss