Hao Li

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified) Description: A free of memory issue not on the heap in Microsoft Office Excel may allow an unauthorized attacker to execute code locally. The vulnerability allows remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows libarchive (affected versions not specified) **Description** The issue is related to an integer overflow in the libarchive library of the Windows operating system. This allows remote attackers to execute arbitrary code and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier **Description** The issue is related to insufficient input validation, which can be exploited by an unauthenticated attacker to cause an application denial-of-service in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. **Recommendations** For versions 120.0.2210.91 and earlier, consider updating to a version that includes a fix for the improper input validation issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue exists due to insufficient input validation in the browser. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue exists due to insufficient input validation in Microsoft Edge. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient input validation when processing FBX files, which can allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat for Edge versions 118.0.2088.46 and earlier **Description** The issue is related to a Use After Free vulnerability in the Adobe PDF component of Microsoft Edge, which can be exploited by an unauthenticated attacker to achieve an application denial-of-service in the context of the current user. This requires user interaction, where a victim must open a malicious file. The vulnerability allows a remote attacker to execute arbitrary code by opening a specially crafted PDF document in the browser. **Recommendations** For Adobe Acrobat for Edge versions 118.0.2088.46 and earlier, update to a version later than 118.0.2088.46 to resolve the issue. As a temporary workaround, consider avoiding the use of Adobe Acrobat for Edge until a patch is available. Restrict access to malicious PDF files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** 3D Viewer (affected versions not specified) **Description** The issue is related to insufficient input validation in the 3D Viewer, which can be exploited to execute arbitrary code using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 3D Viewer (affected versions not specified) **Description** The issue is related to insufficient input validation in the 3D Viewer, which can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 3D Viewer (affected versions not specified) **Description** The 3D Viewer is affected by a remote code execution issue due to insufficient input validation. This can allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions prior to the January 9, 2024 security update Office 2019 Office 2021 Office LTSC for Mac 2021 Microsoft 365 **Description** A security issue exists in FBX that could lead to remote code execution. The vulnerability is related to errors in processing input data, which can be exploited by opening a specially crafted malicious file. To mitigate this issue, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. **Recommendations** For Office 2019, disable the ability to insert FBX files. For Office 2021, disable the ability to insert FBX files. For Office LTSC for Mac 2021, disable the ability to insert FBX files. For Microsoft 365, disable the ability to insert FBX files. As a temporary workaround, consider avoiding the use of FBX files in Office applications until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Edge, allowing an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Edge, allowing an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio (affected versions not specified) **Description** The issue is related to a buffer overflow in memory, allowing an attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** .NET, .NET Framework, and Visual Studio (affected versions not specified) **Description** The issue is related to insufficient input validation in the .NET, .NET Framework, and Visual Studio software platforms. This can be exploited by an attacker to execute arbitrary code using a specially crafted file. The vulnerability allows remote attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Office, which can be exploited to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio (affected versions not specified) **Description** The issue is related to errors in processing input data, which can allow a remote attacker to execute arbitrary code by tricking a user into running a malicious file. This can be achieved through the exploitation of out-of-bounds write and read vulnerabilities in the parsing of certain file types. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio Code (affected versions not specified) **Description** The issue is related to insufficient input validation in the Visual Studio Code editor. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Media Foundation (affected versions not specified) **Description** The issue exists due to insufficient input validation in the Windows Media Foundation component of Windows operating systems. This allows remote attackers to execute arbitrary code and affect the system. The vulnerability can be exploited through the parsing of AVI files, leading to an out-of-bounds write and remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VP9 Video Extensions (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in the VP9 Video Extensions package. Exploitation of this issue may allow an attacker to access confidential information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.