Main Vulnerability Database Vulnerabilities #VU64282

Input validation error in Microsoft Office LTSC and Microsoft 365 Apps for Enterprise - CVE-2022-30174

Published: June 14, 2022

Vulnerability identifier: #VU64282

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30174

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Office. A remote attacker on the local network can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Microsoft Office LTSC
Microsoft 365 Apps for Enterprise

How to mitigate CVE-2022-30174

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30174

Related Security Bulletins