PT-2024-8155 · Microsoft · Office+2

Li Shuang + 1 · Published 2024-11-12 · Updated 2024-11-16 · CVE-2024-49030

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions (affected versions not specified) Microsoft Excel versions (affected versions not specified) Microsoft 365 Apps for Enterprise versions (affected versions not specified)

Description: The issue is related to a buffer overflow in memory, allowing an attacker to execute arbitrary code. This can be exploited by remote attackers, potentially affecting the system.

Recommendations: For Microsoft Office, update to a version that includes a fix for the buffer overflow issue. For Microsoft Excel, consider disabling features that may trigger the buffer overflow until a patch is available. For Microsoft 365 Apps for Enterprise, restrict access to potentially vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-09696

CVE-2024-49030

Affected Products

365 Apps For Enterprise

Office Excel

Office

References · 8

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49030 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49030 · Security Note
• https://bdu.fstec.ru/vul/2024-09696 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49030 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/713739 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49030 · Vendor Advisory
• https://t.me/cvenotify/101884 · Telegram Post
• https://t.me/cvedetector/10689 · Telegram Post