Yonghui Han

**Name of the Vulnerable Software and Affected Versions** Open Design Alliance Drawings SDK versions prior to 2023.3 **Description** An issue exists when reading a DWG file with an invalid vertex number in recovery mode, leading to an Out-of-Bounds Read. This can allow an attacker to execute code in the context of the current process or cause a denial of service. **Recommendations** For versions prior to 2023.3, update to version 2023.3 or later to resolve the issue. As a temporary workaround, consider restricting the processing of DWG files with invalid vertex numbers in recovery mode until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Open Design Alliance Drawings SDK versions prior to 2023.3 **Description** An issue exists in the recovery mode of the Drawings SDK when reading DWG files, allowing for an Out-of-Bounds Read. This can be leveraged by an attacker to execute code in the context of the current process. The vulnerability is related to a buffer overflow in memory when processing DWG files, which can lead to arbitrary code execution or denial of service. **Recommendations** For versions prior to 2023.3, update to version 2023.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the recovery mode when reading DWG files to minimize the risk of exploitation. Avoid using the Drawings SDK to process untrusted DWG files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook versions prior to the fixed version Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified) **Description** The issue is related to errors in the mechanisms for handling objects in memory. Exploitation of this issue may allow an attacker to execute arbitrary code with the privileges of the current user using specially crafted content. To exploit the issue, a user must open a specially crafted file with an affected version of Microsoft Outlook software. The Preview Pane is not an attack vector for this issue. **Recommendations** For Microsoft Outlook, update to a version that includes the fix for this issue. For Office 365 ProPlus, apply the recommended configuration changes to minimize the risk of exploitation. For Microsoft Office, consider restricting access to specially crafted files until a patch is available. As a temporary workaround, consider disabling the handling of specially crafted files in Microsoft Outlook until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a remote code execution problem in Microsoft Outlook, caused by an out-of-bounds memory operation. This can be exploited by a remote attacker using a specially crafted file, allowing them to execute arbitrary code in the context of the current user. To exploit this issue, a user must open the specially crafted file with an affected version of Microsoft Outlook. The Preview Pane is not a viable attack vector for this problem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code using a specially crafted file. To exploit this, a user must open the crafted file with an affected version of Microsoft Outlook. This could enable the attacker to perform actions in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Outlook (affected versions not specified) **Description** The issue is related to a remote code execution problem in Microsoft Outlook, caused by an out-of-bounds memory operation. This can be exploited by a remote attacker using a specially crafted file, allowing them to execute arbitrary code in the context of the current user. To exploit this issue, a user must open the specially crafted file with an affected version of Microsoft Outlook. The Preview Pane is not a viable attack vector for this problem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.