Seungyun Lee

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook versions 2016 Microsoft Office versions 2019 through 2024 **Description** The issue allows remote attackers to execute arbitrary code and affect the system. It is reported that this issue has been patched by Microsoft with the aid of external researchers. **Recommendations** For Microsoft Outlook version 2016, apply the patch provided by Microsoft. For Microsoft Office versions 2019 through 2024, apply the patch provided by Microsoft. As a temporary workaround, consider restricting access to potentially vulnerable components until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions prior to the fixed version Microsoft 365 Apps for Enterprise versions prior to the fixed version **Description** The issue is related to the use of an unreliable path search in Microsoft Office and Microsoft 365 Apps for Enterprise. This allows an attacker to execute arbitrary code. The vulnerability affects Word, PowerPoint, and Outlook. It is described as a logic bug that includes built-in process control and built-in PV bypass. **Recommendations** For Microsoft Office versions prior to the fixed version, update to the fixed version to resolve the issue. For Microsoft 365 Apps for Enterprise versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting the use of built-in processes and PV until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windows Upgrade Assistant (affected versions not specified) **Description** The issue is related to insufficient input validation in the Windows Upgrade Assistant. This can allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** G-RAID 4/8 Software Utility (affected versions not specified) **Description** The issue is related to a DLL hijacking vulnerability in the G-RAID 4/8 Software Utility setups for Windows. This vulnerability could lead to arbitrary code execution in the context of the system user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Click-to-Run (C2R) service for Microsoft Office and Microsoft 365 Apps for Enterprise packages. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.