CVE-2024-38226KEV Β· OVERDUECWE-693

Microsoft Publisher Protection Mechanism Failure Vulnerability

High Β· published September 10, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.3. It is confirmed in active exploitation. It sits in the 85.6th percentile for exploit probability.

753
days past CISA
deadline
CVSS v3.1
7.3
EPSS
3%
Percentile
85.6
In the wild
Confirmed
What it is

🚨 A sneaky feature bypass in Microsoft Publisher could let attackers run amok! πŸ”₯ Think of this like a hotel with a malfunctioning front desk β€” guests can check in without proper IDs and access any room, bypassing all security measures. It’s not just a minor oversight; it puts everyone inside at risk! An attacker exploiting this flaw could execute malicious code remotely, potentially compromising sensitive documents and data. Imagine unauthorized access to your most confidential marketing materials or business plans β€” absolutely devastating! This vulnerability is a ticket to chaos, and all it takes is a clever exploit.

Put simply

Think of this like a hotel with a malfunctioning front desk β€” guests can check in without proper IDs and access any room, bypassing all security measures. It’s not just a minor oversight; it puts everyone inside at risk! This security feature bypass vulnerability allows attackers to circumvent restrictions that should prevent unauthorized actions in Microsoft Publisher, specifically affecting trusted locations and file types.

What to do

An attacker exploiting this flaw could execute malicious code remotely, potentially compromising sensitive documents and data. Imagine unauthorized access to your most confidential marketing materials or business plans β€” absolutely devastating! This vulnerability is a ticket to chaos, and all it takes is a clever exploit. Immediately update Microsoft Publisher to the latest version to patch this vulnerability. Ensure all users are educated on the risks of opening documents from untrusted sources. Additionally, review your organization's security policies to minimize exposure. You've got this! Follow these steps and you'll have your defenses up in no time! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.3 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02667 Β· 85.6th percentile
Weakness
CWE-693 Β· Protection Mechanism Failure
Published
2024-09-10T21:15Z
KEV added
2024-09-10 Β· due 2024-10-01
Affected products (6)
ProductVersionsFixed in
microsoft/office_2019all versionsβ€”
microsoft/office_2019all versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/office_long_term_servicing_channelall versionsβ€”
microsoft/publisherall versionsβ€”
microsoft/publisherall versionsβ€”
References (2)
EPSS history
Timeline
  • 10 SEP 16:53Z
    Microsoft Publisher Security Feature Bypass Vulnerability
    cvelistv5
  • 10 SEP 00:00Z
    Added to CISA KEV β€” remediate by Oct 1
    kev