PT-2022-5863 · Microsoft · Office Excel+2

Published 2022-12-13 · Updated 2023-03-10 · CVE-2022-47213

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft 365 Apps for Enterprise (affected versions not specified)

Description The issue is related to insufficient input validation in the Microsoft Office Graphics component, allowing an attacker to execute arbitrary code using a specially crafted file. This can be achieved through the exploitation of a use-after-free vulnerability when parsing SKP files in Microsoft Excel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-07278

CVE-2022-47213

ZDI-23-050

Affected Products

365 Apps For Enterprise

Office Excel

Office Graphics

References · 10

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-47213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47213 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47213 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-050 · Security Note
• https://bdu.fstec.ru/vul/2022-07278 · Security Note
• https://t.me/cibsecurity/54461 · Telegram Post
• https://t.me/cibsecurity/54465 · Telegram Post
• https://t.me/cvenotify/39982 · Telegram Post
• https://t.me/cvenotify/39983 · Telegram Post
• https://t.me/cibsecurity/54466 · Telegram Post