PT-2022-5621 · Microsoft · 365 Apps For Enterprise+2

Icewall

·

Published

2022-11-08

·

Updated

2026-05-19

·

CVE-2022-41106

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Microsoft Excel versions prior to the fixed version Microsoft Office versions prior to the fixed version Microsoft 365 Apps for Enterprise versions prior to the fixed version Microsoft Office Excel 2019 x86 - version 2207, build 15427.20210 Microsoft Office Excel 365 - version 2202, build 14931.20660
Description The issue exists due to insufficient input validation in Microsoft Excel, allowing an attacker to execute arbitrary code using a specially crafted file. This can be achieved through a double-free vulnerability in the attribute class of Microsoft Office Excel. The exploitation of this issue may enable a remote attacker to affect the system.
Recommendations For Microsoft Excel 2019 x86 - version 2207, build 15427.20210, update to a newer version that includes the fix. For Microsoft Office Excel 365 - version 2202, build 14931.20660, update to a newer version that includes the fix. For other affected versions of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise, update to a newer version that includes the fix. As a temporary workaround, consider avoiding the use of specially crafted files that could exploit the double-free vulnerability in the attribute class of Microsoft Office Excel.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-06987
CVE-2022-41106

Affected Products

365 Apps For Enterprise
Office Excel
Office