CVE-2023-36761KEV · OVERDUECWE-20

Microsoft Word Information Disclosure Vulnerability

Medium · published September 12, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 97.4th percentile for exploit probability.

1117
days past CISA
deadline
CVSS v3.1
6.5
EPSS
20%
Percentile
97.4
In the wild
Confirmed
What it is

⚠️ A tricky information disclosure vulnerability in Microsoft Word could let attackers peek at your sensitive data with just the right crafted document! Think of it like a waiter who accidentally leaves a menu open to the special dish of the day — it reveals way more than it should to anyone passing by. Whether intentional or not, someone could get a closer look at the juicy details you wanted to keep private! If exploited, an attacker could potentially access confidential information from your documents, which could lead to unauthorized data exposure and a loss of privacy. While it's not a full-blown breach, it’s enough to have you looking over your shoulder!

Put simply

Think of it like a waiter who accidentally leaves a menu open to the special dish of the day — it reveals way more than it should to anyone passing by. Whether intentional or not, someone could get a closer look at the juicy details you wanted to keep private! This vulnerability allows attackers to exploit specific crafted Word documents to leak sensitive content from memory, enabling unauthorized access to data that should remain confidential.

What to do

If exploited, an attacker could potentially access confidential information from your documents, which could lead to unauthorized data exposure and a loss of privacy. While it's not a full-blown breach, it’s enough to have you looking over your shoulder! Update to the latest version of Microsoft Word as soon as possible and ensure that all users are aware of the risks associated with untrusted documents. Encourage users to avoid opening documents from unknown sources. 🛡️ You've got this! With a simple update, you can keep your documents safe and secure. Let's fix this together! 💪✨

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.19570 · 97.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-09-12T16:58Z
KEV added
2023-09-12 · due 2023-10-03
EPSS history
Timeline
  • 12 SEP 16:58Z
    Microsoft Word Information Disclosure Vulnerability
    cvelistv5
  • 12 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 3
    kev