PT-2021-6386 · Microsoft · Office Visio

Published 2021-12-08 · Updated 2026-05-19 · CVE-2022-24510

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio (affected versions not specified)

Description The issue is related to errors in data type conversion when implementing the EMR COMMENT EMFPLUS record in an EMF file. Exploitation of this issue may allow an attacker to execute arbitrary code by opening a malicious webpage or file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2022-01420

CVE-2022-24510

ZDI-22-494

Affected Products

Office Visio

References · 10

• https://zerodayinitiative.com/advisories/ZDI-22-494 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24510 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24510 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01420 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24510 · Vendor Advisory
• https://t.me/cibsecurity/38607 · Telegram Post
• https://t.me/cibsecurity/38584 · Telegram Post
• https://t.me/cibsecurity/38592 · Telegram Post
• https://vuldb.com/?id.194440 · Note
• https://twitter.com/f1tym1/status/2056832112930505214 · Twitter Post