Microsoft ActiveX Remote Code Execution Vulnerability
CVE-2023-33152

7HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Office 2019
Microsoft 365 Apps For Enterprise
Microsoft Office Ltsc 2021
Microsoft Office 2016
Vendor
CVE Published:
11 July 2023

Summary

A security flaw has been identified in Microsoft ActiveX that allows remote code execution. This vulnerability could enable an attacker to execute arbitrary code on a user's machine, potentially leading to unauthorized access, data theft, or system compromise. Users and administrators are advised to implement available security updates and follow best practices to mitigate risks associated with this issue.

Affected Version(s)

Microsoft 365 Apps for Enterprise 32-bit Systems 16.0.1

Microsoft Office 2013 Service Pack 1 ARM64-based Systems 15.0.0 < 15.0.5571.1000

Microsoft Office 2016 32-bit Systems 16.0.0 < 16.0.5404.1000

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.