PT-2024-6166 · Microsoft · Office Word

Francesco Benvenuto

·

Published

2024-04-16

·

Updated

2025-08-22

·

CVE-2024-41165

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Microsoft Word version 16.83
Description A library injection vulnerability exists in Microsoft Word for macOS. This issue allows a specially crafted library to leverage Word's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability, then make use of the vulnerable application's permissions. The vulnerability is related to incorrect cryptographic signature verification.
Recommendations For Microsoft Word version 16.83, consider disabling the use of external libraries until a patch is available. Restrict access to the application to minimize the risk of exploitation. Avoid using the application for sensitive tasks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2024-07086
CVE-2024-41165

Affected Products

Office Word